daadc2d16ec341286d1d03ec16d261c8593655129478a014b99fbfb014337ec6

Resubmissions

08/09/2026, 15:36

260908-s1784sdr4z

08/09/2026, 10:37

08/09/2026, 10:35

11/08/2026, 14:17

04/08/2026, 13:07

Analysis

user interaction
yes
max time kernel
47s
max time network
48s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
08/09/2026, 10:35

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
indir (1).png
Size 656KB
Sample260908-mm4e4sybke
SHA256 daadc2d16ec341286d1d03ec16d261c8593655129478a014b99fbfb014337ec6
MD5 0ac32a48cea9f5d27ea12687be3b6f2e
SHA1 d34b442eb18a7a542c9054a3e29174f3307976e5
SHA512 cd26cfd4bb91c88f64c2dcc224ebb1b2959507ef7b5be6bde3b6b5d6eb9f33a63872cbe4d409bd488e66deb771bd357ca9aa00ed040de7c631ed1ab3a530711a
SSDEEP 12288:n8v8E4JGuI6gW1Y8ddYuBIiW/sF9xpJA9BVSJt6fhhUUWGDFIfUdn9P:n8UjQ6gg3deu6/s5I4n6fhhFTCfO9P
TLSH
T1BEE4237DC2D85DFFF23B13294968910D22F0D499FF8595A28877E20B9F627036A84E74
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
640	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134333374086470384"	msedge.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-876885714-46325919-1482798410-1000\{A2B26F9A-0780-4C75-83A8-4882370853AA}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4624	mspaint.exe
4624	mspaint.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
1532	msedge.exe
1532	msedge.exe
1532	msedge.exe
1532	msedge.exe
1532	msedge.exe
1532	msedge.exe

Suspicious use of FindShellTrayWindow 3 IoCs

pid	Process
1532	msedge.exe
1532	msedge.exe
1532	msedge.exe

Suspicious use of SetWindowsHookEx 4 IoCs

pid	Process
4624	mspaint.exe
4624	mspaint.exe
4624	mspaint.exe
4624	mspaint.exe

Suspicious use of WriteProcessMemory 43 IoCs

description	pid	Process	procid_target
PID 1040 wrote to memory of 1532	1040	msedge.exe	97
PID 1532 wrote to memory of 2824	1532	msedge.exe	98
PID 1532 wrote to memory of 3468	1532	msedge.exe	99
PID 1532 wrote to memory of 640	1532	msedge.exe	100
PID 1532 wrote to memory of 3468	1532	msedge.exe	99
PID 1532 wrote to memory of 3468	1532	msedge.exe	99
PID 1532 wrote to memory of 3576	1532	msedge.exe	101
PID 1532 wrote to memory of 3576	1532	msedge.exe	101
PID 1532 wrote to memory of 2904	1532	msedge.exe	102
PID 1532 wrote to memory of 4872	1532	msedge.exe	103
PID 1532 wrote to memory of 2904	1532	msedge.exe	102
PID 1532 wrote to memory of 2904	1532	msedge.exe	102
PID 1532 wrote to memory of 4872	1532	msedge.exe	103
PID 1532 wrote to memory of 4872	1532	msedge.exe	103
PID 1532 wrote to memory of 4440	1532	msedge.exe	105
PID 1532 wrote to memory of 4440	1532	msedge.exe	105
PID 1532 wrote to memory of 4440	1532	msedge.exe	105
PID 1532 wrote to memory of 2768	1532	msedge.exe	106
PID 1532 wrote to memory of 2768	1532	msedge.exe	106
PID 1532 wrote to memory of 2768	1532	msedge.exe	106
PID 1532 wrote to memory of 4820	1532	msedge.exe	109
PID 1532 wrote to memory of 4820	1532	msedge.exe	109
PID 1532 wrote to memory of 4892	1532	msedge.exe	110
PID 1532 wrote to memory of 4892	1532	msedge.exe	110
PID 1532 wrote to memory of 1092	1532	msedge.exe	112
PID 1532 wrote to memory of 1092	1532	msedge.exe	112
PID 1532 wrote to memory of 1092	1532	msedge.exe	112
PID 1532 wrote to memory of 876	1532	msedge.exe	113
PID 1532 wrote to memory of 3400	1532	msedge.exe	114
PID 1532 wrote to memory of 876	1532	msedge.exe	113
PID 1532 wrote to memory of 3400	1532	msedge.exe	114
PID 1532 wrote to memory of 796	1532	msedge.exe	116
PID 1532 wrote to memory of 4680	1532	msedge.exe	117
PID 1532 wrote to memory of 4680	1532	msedge.exe	117
PID 1532 wrote to memory of 972	1532	msedge.exe	118
PID 1532 wrote to memory of 972	1532	msedge.exe	118
PID 1532 wrote to memory of 2444	1532	msedge.exe	119
PID 1532 wrote to memory of 2444	1532	msedge.exe	119
PID 1532 wrote to memory of 2444	1532	msedge.exe	119
PID 1532 wrote to memory of 1220	1532	msedge.exe	120
PID 1532 wrote to memory of 4336	1532	msedge.exe	121
PID 1532 wrote to memory of 1220	1532	msedge.exe	120
PID 1532 wrote to memory of 4336	1532	msedge.exe	121

C:\Windows\system32\mspaint.exe
"C:\Windows\system32\mspaint.exe" "C:\Users\Admin\AppData\Local\Temp\indir (1).png"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:4624

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s DeviceAssociationService
1⤵
PID:4684

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://appdata/
1⤵
- Suspicious use of WriteProcessMemory
PID:1040
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --edge-skip-compat-layer-relaunch --single-argument http://appdata/
  2⤵
  - Checks processor information in registry
  - Enumerates system info in registry
  - Modifies data under HKEY_USERS
  - Modifies registry class
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:1532
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x234,0x238,0x23c,0x230,0x244,0x7ffef1ddc188,0x7ffef1ddc194,0x7ffef1ddc1a0
    3⤵
    PID:2824
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1684,i,234731132672603417,535581435695723333,262144 --field-trial-handle=2292,i,4406058049349663810,10908743839011399577,262144 --variations-seed-version --mojo-platform-channel-handle=2288 /prefetch:2
    3⤵
    PID:3468
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1812,i,11679339349182967496,7229289290478774850,524288 --field-trial-handle=2292,i,4406058049349663810,10908743839011399577,262144 --variations-seed-version --mojo-platform-channel-handle=2320 /prefetch:3
    3⤵
    - System Time Discovery
    PID:640
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2608,i,8533543175152990374,4884045838830129592,524288 --field-trial-handle=2292,i,4406058049349663810,10908743839011399577,262144 --variations-seed-version --mojo-platform-channel-handle=2776 /prefetch:8
    3⤵
    PID:3576
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3452,i,12578103184734505280,953595637512830888,2097152 --field-trial-handle=2292,i,4406058049349663810,10908743839011399577,262144 --variations-seed-version --mojo-platform-channel-handle=3536 /prefetch:1
    3⤵
    PID:2904
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3456,i,4962153840365413373,6744615002756740429,2097152 --field-trial-handle=2292,i,4406058049349663810,10908743839011399577,262144 --variations-seed-version --mojo-platform-channel-handle=3540 /prefetch:1
    3⤵
    PID:4872
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4224,i,5331068257525031025,5288945529283603983,2097152 --field-trial-handle=2292,i,4406058049349663810,10908743839011399577,262144 --variations-seed-version --mojo-platform-channel-handle=4228 /prefetch:1
    3⤵
    PID:4440
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4236,i,930864630692182143,3409617073332252947,2097152 --field-trial-handle=2292,i,4406058049349663810,10908743839011399577,262144 --variations-seed-version --mojo-platform-channel-handle=4288 /prefetch:2
    3⤵
    PID:2768
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3496,i,10799980949205491061,16876650246267543308,524288 --field-trial-handle=2292,i,4406058049349663810,10908743839011399577,262144 --variations-seed-version --mojo-platform-channel-handle=3644 /prefetch:8
    3⤵
    PID:4820
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5252,i,10300648383009672875,13023858796311071162,524288 --field-trial-handle=2292,i,4406058049349663810,10908743839011399577,262144 --variations-seed-version --mojo-platform-channel-handle=5060 /prefetch:8
    3⤵
    PID:4892
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --always-read-main-dll --metrics-shmem-handle=5232,i,8226112871513438765,18063446962037476735,2097152 --field-trial-handle=2292,i,4406058049349663810,10908743839011399577,262144 --variations-seed-version --mojo-platform-channel-handle=5276 /prefetch:1
    3⤵
    PID:1092
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5508,i,3977584150344161027,14313668577957316044,524288 --field-trial-handle=2292,i,4406058049349663810,10908743839011399577,262144 --variations-seed-version --mojo-platform-channel-handle=5376 /prefetch:8
    3⤵
    PID:876
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5248,i,14795170821952064962,12180206438113058988,524288 --field-trial-handle=2292,i,4406058049349663810,10908743839011399577,262144 --variations-seed-version --mojo-platform-channel-handle=5212 /prefetch:8
    3⤵
    PID:3400
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5956,i,4073082568347654536,1944102345009778232,524288 --field-trial-handle=2292,i,4406058049349663810,10908743839011399577,262144 --variations-seed-version --mojo-platform-channel-handle=5976 /prefetch:8
    3⤵
    PID:3264
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5956,i,4073082568347654536,1944102345009778232,524288 --field-trial-handle=2292,i,4406058049349663810,10908743839011399577,262144 --variations-seed-version --mojo-platform-channel-handle=5976 /prefetch:8
    3⤵
    PID:796
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6128,i,1822758404870359208,6010220475743908729,524288 --field-trial-handle=2292,i,4406058049349663810,10908743839011399577,262144 --variations-seed-version --mojo-platform-channel-handle=6124 /prefetch:8
    3⤵
    PID:4680
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6256,i,15438376152858793227,6339602930912998739,524288 --field-trial-handle=2292,i,4406058049349663810,10908743839011399577,262144 --variations-seed-version --mojo-platform-channel-handle=6260 /prefetch:8
    3⤵
    PID:972
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --always-read-main-dll --metrics-shmem-handle=6276,i,9839337674437751033,15591581179083694640,2097152 --field-trial-handle=2292,i,4406058049349663810,10908743839011399577,262144 --variations-seed-version --mojo-platform-channel-handle=6252 /prefetch:1
    3⤵
    PID:2444
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4196,i,18029617506918112620,15245376235770441019,524288 --field-trial-handle=2292,i,4406058049349663810,10908743839011399577,262144 --variations-seed-version --mojo-platform-channel-handle=3208 /prefetch:8
    3⤵
    PID:1220
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3296,i,17564882907956341269,14652111561722419204,524288 --field-trial-handle=2292,i,4406058049349663810,10908743839011399577,262144 --variations-seed-version --mojo-platform-channel-handle=2944 /prefetch:8
    3⤵
    PID:4336

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:2472

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

blocklist

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\blocklist
Size 105KB
SHA256 2cfe0e512fe66762495535e6076a96bb4e6ed6f34c98c4a7f8df941ef3c8c17c
MD5 5c148bcc6fa502a2fee964c0dd6afdfc
SHA1 9199b6a7ccde16500ea75a0020ab5db0df5569d4
SHA512 4631fdc4ed2e6e278c330749a012433d939adf4beecbd21c6f7a1cb60fe9640888daa64ec4b81642fafbb45e59921d422ffcb8d6579eb20f08c08622b263623c
SSDEEP 1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P7B:fwUQC5VwBIiElEd2K57P7B
TLSH
T113B3B931457E36BF26E93EE828CF1511B84F3912664895D4ABE1FE2C4845E68633CEF4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 4a302129b10cf3ac8d6fd58a3a115f3f386534b351087f5a1cace69357f97312
MD5 77728a4729b6fd40e598dd660abe576a
SHA1 68496608431a924a2d7c2121e8150e4f311e8140
SHA512 f142cd9419f9f0c16da905686ab4285a9458d6c66c5b6488e9a2585b7c19e4585467885a2c2b0f98da0edcf3314d34c539118044e770f5666f21a0196dfc6daa
TLSH
T1D6D02330A9DCFCE0E0360438813103027DCD8A893483A307B000441E4C753C373D94B3
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 6de34b260036ecaa4ce5839bc4a7ff7495e50b7b94349b12d9f840ca0e76da3b
MD5 56d82099872fb501c566d072ae897035
SHA1 2c96501551fc13c09496780960d8e7ccb4957b77
SHA512 c4b4017256caf25e88f146e6104134cddfd15089203e8e74c5196627fc92897f9fe7e3fc5c8305032be88e9409cdbc5dfe1e81017fcd5e38b3579b3d823b4a41
TLSH
T160D0C073378C7C00EA090170D013C3031FA7855824C39F03B100C01C54B43D9738B093
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 f5dece638cd89af82b06bd2fcb3d1738eef64d2275be237184ea8bff7af3fdfa
MD5 f19ec2293392af872f10929c41627e26
SHA1 0576f5277c470f5bb8c3f4d3786ca8d967d0a33e
SHA512 4cc85dc71d34bb516f8fe45b565a6a9b4cda255a931f33289247ed84150baf0e2df40fc87109df41771553b92545ed858197cdd3d673694c83458cf9812aa9dd
TLSH
T16CD02272268C6C00EA090170D01383021EA6855824839B03A100C01C44A52D9728A093
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 3fe34e87bded2b61acd751c6a5135f466426c5d0e0549c18ec7d9416825bf079
MD5 e9a5259e35d368da2a3affeefebc0517
SHA1 989df724f5a29354a2c59889b03a5f8377edacc3
SHA512 5310e216f3cdfe62775de3eea613677ad5aa21c71c94b98b17a8fedf504c6c16b3b0d0cb057835ab71769440af4cfebff89cb571c7705c168acb4e430fc40b88
TLSH
T199712B3726424952D34020B1E8A91B50F6BDCC9D8DC77E6A1E904DFEF519747B306CC9
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5912b3.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe5912b3.TMP
Size 3KB
SHA256 7eff321c0b1a3a8cbc0b054d3b0e87947dcc4433f2f1ac25a49236852762891a
MD5 126a5226a549018a1149a465e4808860
SHA1 68be06737fcb9f0e7155d95c2b960c5f6be3e186
SHA512 7ce1c6cd9ab82d79476b8cad04ffcb968230a10c5463296afdd601bf17a008a8b0276cc27bc84dfd10163bf2e0007a8f9a11784cee94f768e80395ef742d5569
TLSH
T1B871293726424952D34021B0E8A91754F6BDCC9D8DC77E6A1D908DFEF919747B306CC8
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 1KB
SHA256 dafc1f1c2bf7d237a269da1b9c126adf8c6ef7cea3771bc3faf9ec0c05061002
MD5 0c7969511097c33f7376eba2bdea1540
SHA1 092e56c5fdd4383da699d11fb086eeb0729cba21
SHA512 948d5757d46bac052a483c42893f2c9cdb0ce695e04fc41af34807a5b3b835ba62cdbf682c6f56dbefa27cbc1f96769d59ca747ad9f5e3aa9af890e779465fe4
TLSH
T1522188F7C3E4996D890197F4AA14AF1BCE6D0A05421C3C1A85E4AE2B93E2465E240A9F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 738c078694a03d13179516cd21859a31415c91167e5b677b2e5cdffb19aaf91f
MD5 3549af40c87309d0f318f287ce7a3bc8
SHA1 0bdb8ea9080f3d0e60387edd41582832b4ca5a07
SHA512 0e1be6b84140e4cf1c223f32839c821857917f2ff402779e25c5b82d6c712f7aac4d070b514334147b09e4602b65c1b8b7a13c930fe74b0a7c5ab707c2242085
SSDEEP 192:sxZ0R6yM/jK1Ml81jj/fSsgWpVhCLSEdpngSHW6+WNGYIV0gsrmIgyJ:sxZ0ssj/fSsgWvhqlpHbGoCO
TLSH
T18952E705AA34A97BCCDBD20DFA557F53D6F91422A2904E449AFCCA1C01F6AED2217C1F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 30KB
SHA256 4ae4dfa0ac05ac367784743820f73d32e5406131364d70d8dca1c073ef8f53cf
MD5 6e19ee82c0420b1642443cd3f12ade6e
SHA1 0aa6071dc9d2140000fe3a03f69b4e7979925bc6
SHA512 15972bc845256170ac7d4c34867dcef3df2703d7ddb12a90aa231810c3368c295b93eb4974632c711713a0df1c90b6c52b39bb0e2c8d8fe97f6e3fa34fb13e17
SSDEEP 768:854jeWmWvmKLE8F1+UoAYDCx9Tuqh0VfUC9xbog/OV/PLlrZ+dLrohhcsae:854jeWmWvmKLEu1jaoPLZQd4kG
TLSH
T1C5E20B3B280CCB7E4F844E5CED26AE976ED801CB6A584D5447FA854C03C77EB512B49B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 707996a9edd4e586cc9cb08b21c4f5c6b8ac59f3786cb34617817785d25a8fd3
MD5 6511b161469931f3abf4696d54161f62
SHA1 c4f539abc7323325549992c2cdc457f8578085aa
SHA512 afabd2fada01fc84c3a7a746b9b54d004aa6fba073317362d7705e0417e2cea8eaeb31fdf2d1f3efba703e3b5cef737f887ba296ed44f4d7d5d676e241774238
SSDEEP 96:KPYDMoGi+cmypHUwcKsJUecI4oJ24Bp65OaQwgSmdcWUx/KsuUP/ILDUt2AoK5yv:UlXajW
TLSH
T1F091182139FA02122D7E360C85E09B2BAF467593315DE92B375C11B18E6AE254DFCCDD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 d90bcc26a5a9176fd4f68a1f2266be9eaebbe0ced6cc7b803da9d866b5fc8423
MD5 d9a51cff053b493eee4accc576612be8
SHA1 33e1dae39ab9abebd3882d6cba10a343f52117d9
SHA512 130497377781d009c106c89d4cf3b0983b4438c449499bfbeab2def9126ec631637e8ec5c8b7daf224e7506fb6c143d341387b827d2d7c63eb34fd17d27c0a87
SSDEEP 192:EONQ6hZ0QmiUyIXpc/+jV0jzor2e5wOZpdlU6:EONQ6onpu+682t2nlU6
TLSH
T12802E935A8687C7B8EE2AE45F48737235FE5116BA9956F84DAFC1B1C00C769C2307822
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 0112f629ddf2f4780df43ba7dbd368ee4043033bfed12d2892b9dc131322b33a
MD5 002f83f0dcccd172afb8a617bc3c0da2
SHA1 ae5316fb7356d874f45bb3b59f4190f838a8453c
SHA512 58157a417b92c71c6ffa5af829a27c39ff6ce6ef0d324d6dd373f3076a36b532e1c728f6e5c74526c63e8ce53c3013ecb086736223dde40ad660d970ebcdf528
SSDEEP 192:XON96hZyQmiUyhX4c/+jV0jzor2IXQN2D5cOqcqTU6:XON96qU4u+682IXeb9pU6
TLSH
T14812DA36A868BC675DD2A551F09732139EE55227EEC5BF84D6EC1F1D00DB6AC130AC13
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 24KB
SHA256 9e164f1dc377a1a57d7b10bff5e7a33c30af240c6a6270c3b7589f18504beb6d
MD5 d33cc0bc4af24d6027cb2edba68da80f
SHA1 13befb253f4ba8c6ecec0619fc04e5c0b32980fa
SHA512 652a0e6943dd03668c711e5863a4e340b99b02fc73447f4df498ac829fd4a2f029ebc8d4c047fefe4c72ae3407eaacb0c13f175247e8eb7640f7d13d0f1fb930
SSDEEP 384:nmZcIfsNcLioCl3BIf+682IXevFlIA8tQM1oAQT96MHlsa+VYglloS:0fWQGoB8IAQT9hFhgTd
TLSH
T1DBB25B70D9A81DE784E2DAC5A546E2131EF8017785CD9E1CE6F9BB3A209F5F91312C23
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\ShaderCache\data_1
Size 264KB
SHA256 b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec
MD5 f50f89a0a91564d0b8a211f8921aa7de
SHA1 112403a17dd69d5b9018b8cede023cb3b54eab7d
SHA512 bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58
SSDEEP 3:MsEllllkEthXllkl2zE:/M/xT02z
MD5 SHA1 SHA512 SSDEEP

Submit Download

179cf077-16c3-4d96-872e-be198d82b9f7.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\179cf077-16c3-4d96-872e-be198d82b9f7.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 dbed8b58e75e510ffdb86d501ec162d343622109ae57efeec001b9bc99dbb148
MD5 7a3b497f7e8136a397ae970783dd9aa0
SHA1 672e4758032e0241fe8ca2af8c48b55831defb9b
SHA512 647be5e59d64bc57872bb2e99640d1859bca9b5d2344be74867dcef85cef6b17c2dbd72bdd4c271ce66c46619aa78237a59a9148965b1f8d77dba79705d25854
TLSH
T1BE412C58B7FA1158B3B36E1A6FF7982D487B79332E06D45D10010E4F4666A40CC71B37
MD5 SHA1 SHA512 TLSH

Submit Download

4aafc8de-5222-41a7-b014-13f642d06a92.tmp

Path C:\Users\Admin\AppData\Local\Temp\4aafc8de-5222-41a7-b014-13f642d06a92.tmp
Size 1B
SHA256 cdb4ee2aea69cc6a83331bbe96dc2caa9a299d21329efb0336fc02a82e1839a8
MD5 5058f1af8388633f609cadb75a75dc9d
SHA1 3a52ce780950d4d969792a2559cd519d7ee8c727
SHA512 0b61241d7c17bcbb1baee7094d14b7c451efecc7ffcbd92598a0f13d313cc9ebc2a07e61f007baf58fbf94ff9a8695bdd5cae7ce03bbf1e94e93613a00f25f21
MD5 SHA1 SHA512

Submit Download

b774ce34-525c-4778-890a-580b594cf97a.tmp

Path C:\Users\Admin\AppData\Local\Temp\b774ce34-525c-4778-890a-580b594cf97a.tmp
Size 10KB
SHA256 67d161098be68cd24febc0c7b48f515f199dda72f20ae3bbb97fcf2542bb0550
MD5 78e47dda17341bed7be45dccfd89ac87
SHA1 1afde30e46997452d11e4a2adbbf35cce7a1404f
SHA512 9574a66d3756540479dc955c4057144283e09cae11ce11ebce801053bb48e536e67dc823b91895a9e3ee8d3cb27c065d5e9030c39a26cbf3f201348385b418a5
SSDEEP 192:YEKh1jNlwQbamjq6Bcykrs3kAVg55GzVQM5F+XwsxNv7/lsoltBq0WG4ZeJTmrRb:fKT/BAzA05Gn5F+XV7NNltrWG4kJTm1b
TLSH
T19D32CFB695286380C58EE63D86423BE3130AFBF8CC05F156815069D768A13591B4B8BF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

2788e667-766b-4971-adb2-273b264d8c34.tmp

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir1532_2076100789\2788e667-766b-4971-adb2-273b264d8c34.tmp
Size 154KB
SHA256 e56c9164b667ad97b0cefcb26e48bcb2b04d8cc1a362ee921f2119a6a8798000
MD5 a922bd2071b7aa9f2154c991d41885c7
SHA1 c88b22d16c951cbb0bfdab367232cf830e0464d1
SHA512 d8ed2d6b1c3a421a9771e3a5109eaea839bf64be7b7e672ed7b8aa47590ff35c6e78aa79712ce37801cedc56db552fc6a7c3ca55004295a438219ce4a8f007a0
SSDEEP 3072:Aj0amyoD1f5NQQHyR5nYbGnkBEGsvsq5UBkUM4RIJ+37HVeCsKkwQuBp/Z:AoHBD15HEYbQkovswoM4RIIzvXkwtBpB
TLSH
T12BF3F11D7EDAC952C40B92BD3C1AB18BC94B8F0A431674CF264D90248EA578E07E5EFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download