hxxps://accounts[.]nvgs[.]nvidia[.]com/api/1/message/VerifyEmail?q=eyJhbGciOiJIUzI1NiJ9[.]eyJtZXNzYWdlSWQiOiIxNTQ2OTQ2ODY2NzQ1Mjk0ODQ4Iiwic2UiOiItIiwicmVkaXJlY3RVcmwiOiJodHRwczovL2xvZ2luLm52Z3MubnZpZGlhLmNvbS92MS9uZmFjdG9yL2VtYWlsLWF1dGg_Y29kZT1UX1VncUhOVldoc0g2Wm9aQWZjQkFVTXJzNm5WVTlJazlrLTJsazZfcm5RWHFaRG1NRTZqdnB6RnZUcy0wTUFPLk1UVTBOamswTmpnMk5qWTJNVFF3T0RjMk9BPT0mdGhlbWU9Tm9pciZsb2NhbGU9ZW4tVVMiLCJpZCI6IiIsImp0aSI6IjVkZjdkNGFjLTZjZjAtNDc5Yy1iYmVhLWFhNmNhM2JmMWZkMyJ9[.]gaFkcAvnfVjpf-ojYhLDusbNL976S6FxU9rtuxpt3IY

Analysis

max time kernel
148s
max time network
140s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
08/09/2026, 18:15

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://accounts.nvgs.nvidia.com/api/1/message/VerifyEmail?q=eyJhbGciOiJIUzI1NiJ9.eyJtZXNzYWdlSWQiOiIxNTQ2OTQ2ODY2NzQ1Mjk0ODQ4Iiwic2UiOiItIiwicmVkaXJlY3RVcmwiOiJodHRwczovL2xvZ2luLm52Z3MubnZpZGlhLmNvbS92MS9uZmFjdG9yL2VtYWlsLWF1dGg_Y29kZT1UX1VncUhOVldoc0g2Wm9aQWZjQkFVTXJzNm5WVTlJazlrLTJsazZfcm5RWHFaRG1NRTZqdnB6RnZUcy0wTUFPLk1UVTBOamswTmpnMk5qWTJNVFF3T0RjMk9BPT0mdGhlbWU9Tm9pciZsb2NhbGU9ZW4tVVMiLCJpZCI6IiIsImp0aSI6IjVkZjdkNGFjLTZjZjAtNDc5Yy1iYmVhLWFhNmNhM2JmMWZkMyJ9.gaFkcAvnfVjpf-ojYhLDusbNL976S6FxU9rtuxpt3IY
Sample260908-wv61mswerd

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4636	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134333649483834933"	msedge.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1074038928-2032447174-945360078-1000\{4A7C5FAF-8731-4295-BE93-86D163BF2B42}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3328	msedge.exe
3328	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
4988	msedge.exe
4988	msedge.exe
4988	msedge.exe
4988	msedge.exe
4988	msedge.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
4988	msedge.exe
4988	msedge.exe
4988	msedge.exe
4988	msedge.exe
4988	msedge.exe
4988	msedge.exe
4988	msedge.exe
4988	msedge.exe
4988	msedge.exe
4988	msedge.exe
4988	msedge.exe
4988	msedge.exe
4988	msedge.exe
4988	msedge.exe
4988	msedge.exe
4988	msedge.exe
4988	msedge.exe
4988	msedge.exe
4988	msedge.exe
4988	msedge.exe
4988	msedge.exe
4988	msedge.exe
4988	msedge.exe
4988	msedge.exe
4988	msedge.exe
4988	msedge.exe
4988	msedge.exe
4988	msedge.exe
4988	msedge.exe
4988	msedge.exe
4988	msedge.exe
4988	msedge.exe
4988	msedge.exe
4988	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
4988	msedge.exe
4988	msedge.exe
4988	msedge.exe
4988	msedge.exe
4988	msedge.exe
4988	msedge.exe
4988	msedge.exe
4988	msedge.exe
4988	msedge.exe
4988	msedge.exe
4988	msedge.exe
4988	msedge.exe
4988	msedge.exe
4988	msedge.exe
4988	msedge.exe
4988	msedge.exe
4988	msedge.exe
4988	msedge.exe
4988	msedge.exe
4988	msedge.exe
4988	msedge.exe
4988	msedge.exe
4988	msedge.exe
4988	msedge.exe
4988	msedge.exe
4988	msedge.exe
4988	msedge.exe
4988	msedge.exe
4988	msedge.exe
4988	msedge.exe
4988	msedge.exe
4988	msedge.exe

Suspicious use of WriteProcessMemory 30 IoCs

description	pid	Process	procid_target
PID 4988 wrote to memory of 5064	4988	msedge.exe	86
PID 4988 wrote to memory of 4636	4988	msedge.exe	87
PID 4988 wrote to memory of 4920	4988	msedge.exe	88
PID 4988 wrote to memory of 4920	4988	msedge.exe	88
PID 4988 wrote to memory of 4920	4988	msedge.exe	88
PID 4988 wrote to memory of 4168	4988	msedge.exe	89
PID 4988 wrote to memory of 4168	4988	msedge.exe	89
PID 4988 wrote to memory of 4568	4988	msedge.exe	91
PID 4988 wrote to memory of 4568	4988	msedge.exe	91
PID 4988 wrote to memory of 3236	4988	msedge.exe	92
PID 4988 wrote to memory of 4568	4988	msedge.exe	91
PID 4988 wrote to memory of 3236	4988	msedge.exe	92
PID 4988 wrote to memory of 3236	4988	msedge.exe	92
PID 4988 wrote to memory of 3356	4988	msedge.exe	93
PID 4988 wrote to memory of 4272	4988	msedge.exe	94
PID 4988 wrote to memory of 3356	4988	msedge.exe	93
PID 4988 wrote to memory of 3356	4988	msedge.exe	93
PID 4988 wrote to memory of 4272	4988	msedge.exe	94
PID 4988 wrote to memory of 4272	4988	msedge.exe	94
PID 4988 wrote to memory of 1136	4988	msedge.exe	97
PID 4988 wrote to memory of 1136	4988	msedge.exe	97
PID 4988 wrote to memory of 2524	4988	msedge.exe	98
PID 4988 wrote to memory of 2524	4988	msedge.exe	98
PID 4988 wrote to memory of 1412	4988	msedge.exe	100
PID 4988 wrote to memory of 2136	4988	msedge.exe	109
PID 4988 wrote to memory of 4764	4988	msedge.exe	110
PID 4988 wrote to memory of 2792	4988	msedge.exe	111
PID 4988 wrote to memory of 1812	4988	msedge.exe	113
PID 4988 wrote to memory of 1812	4988	msedge.exe	113
PID 4988 wrote to memory of 3328	4988	msedge.exe	115

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://accounts.nvgs.nvidia.com/api/1/message/VerifyEmail?q=eyJhbGciOiJIUzI1NiJ9.eyJtZXNzYWdlSWQiOiIxNTQ2OTQ2ODY2NzQ1Mjk0ODQ4Iiwic2UiOiItIiwicmVkaXJlY3RVcmwiOiJodHRwczovL2xvZ2luLm52Z3MubnZpZGlhLmNvbS92MS9uZmFjdG9yL2VtYWlsLWF1dGg_Y29kZT1UX1VncUhOVldoc0g2Wm9aQWZjQkFVTXJzNm5WVTlJazlrLTJsazZfcm5RWHFaRG1NRTZqdnB6RnZUcy0wTUFPLk1UVTBOamswTmpnMk5qWTJNVFF3T0RjMk9BPT0mdGhlbWU9Tm9pciZsb2NhbGU9ZW4tVVMiLCJpZCI6IiIsImp0aSI6IjVkZjdkNGFjLTZjZjAtNDc5Yy1iYmVhLWFhNmNhM2JmMWZkMyJ9.gaFkcAvnfVjpf-ojYhLDusbNL976S6FxU9rtuxpt3IY
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4988
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x260,0x7ffa415bc188,0x7ffa415bc194,0x7ffa415bc1a0
  2⤵
  PID:5064
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2000,i,14291820222410316,11855668141111761596,524288 --field-trial-handle=2124,i,12128310081848463851,8688633936690344541,262144 --variations-seed-version --mojo-platform-channel-handle=2368 /prefetch:3
  2⤵
  - System Time Discovery
  PID:4636
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1760,i,5993318903038368253,11773772549283633071,262144 --field-trial-handle=2124,i,12128310081848463851,8688633936690344541,262144 --variations-seed-version --mojo-platform-channel-handle=2116 /prefetch:2
  2⤵
  PID:4920
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2568,i,8709205563254659252,17747809878440032727,524288 --field-trial-handle=2124,i,12128310081848463851,8688633936690344541,262144 --variations-seed-version --mojo-platform-channel-handle=2748 /prefetch:8
  2⤵
  PID:4168
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3464,i,6686300638085006521,6988234994362521883,2097152 --field-trial-handle=2124,i,12128310081848463851,8688633936690344541,262144 --variations-seed-version --mojo-platform-channel-handle=3484 /prefetch:1
  2⤵
  PID:4568
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3104,i,17452954282978791114,1761802303912865295,2097152 --field-trial-handle=2124,i,12128310081848463851,8688633936690344541,262144 --variations-seed-version --mojo-platform-channel-handle=3480 /prefetch:1
  2⤵
  PID:3236
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4204,i,7696835410718507857,12944236679891857332,2097152 --field-trial-handle=2124,i,12128310081848463851,8688633936690344541,262144 --variations-seed-version --mojo-platform-channel-handle=4228 /prefetch:2
  2⤵
  PID:3356
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4196,i,11958521228605659717,5926614397971569863,2097152 --field-trial-handle=2124,i,12128310081848463851,8688633936690344541,262144 --variations-seed-version --mojo-platform-channel-handle=4224 /prefetch:1
  2⤵
  PID:4272
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5196,i,10292748187559347273,882450249704071489,524288 --field-trial-handle=2124,i,12128310081848463851,8688633936690344541,262144 --variations-seed-version --mojo-platform-channel-handle=5176 /prefetch:8
  2⤵
  PID:1136
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5188,i,2418902704335241759,4361430715025038293,524288 --field-trial-handle=2124,i,12128310081848463851,8688633936690344541,262144 --variations-seed-version --mojo-platform-channel-handle=5208 /prefetch:8
  2⤵
  PID:2524
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5928,i,6898707855831340195,3561319924571182471,524288 --field-trial-handle=2124,i,12128310081848463851,8688633936690344541,262144 --variations-seed-version --mojo-platform-channel-handle=5956 /prefetch:8
  2⤵
  PID:2376
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5928,i,6898707855831340195,3561319924571182471,524288 --field-trial-handle=2124,i,12128310081848463851,8688633936690344541,262144 --variations-seed-version --mojo-platform-channel-handle=5956 /prefetch:8
  2⤵
  PID:1412
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4268,i,17346186977667428781,7021051110893714568,524288 --field-trial-handle=2124,i,12128310081848463851,8688633936690344541,262144 --variations-seed-version --mojo-platform-channel-handle=4276 /prefetch:8
  2⤵
  PID:2136
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4280,i,13927933337372121082,2736607934503211559,524288 --field-trial-handle=2124,i,12128310081848463851,8688633936690344541,262144 --variations-seed-version --mojo-platform-channel-handle=4272 /prefetch:8
  2⤵
  PID:4764
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4204,i,1541976709537374255,6902553181280454998,524288 --field-trial-handle=2124,i,12128310081848463851,8688633936690344541,262144 --variations-seed-version --mojo-platform-channel-handle=4352 /prefetch:8
  2⤵
  PID:2792
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5416,i,4669894735035778938,8468727048563112461,524288 --field-trial-handle=2124,i,12128310081848463851,8688633936690344541,262144 --variations-seed-version --mojo-platform-channel-handle=5620 /prefetch:8
  2⤵
  PID:1812
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6156,i,4877363051269918414,7142937787108707404,262144 --field-trial-handle=2124,i,12128310081848463851,8688633936690344541,262144 --variations-seed-version --mojo-platform-channel-handle=6148 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3328

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:3308

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

0fcaf430-1f5e-48f9-91f5-03f524528eba.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\0fcaf430-1f5e-48f9-91f5-03f524528eba.tmp
Size 105KB
SHA256 f0ead82c3c8a4cd9959a8cd1cef74705c67e276b4a574243e75c890cb0b0b8fe
MD5 f8a5a8774310485121aa8917052b352c
SHA1 78542cc17bce16f7d0117a4beed6ae29c39c3042
SHA512 94c06ac4086f7321e54c95657a2fc0769092ed3577572d27a9a75f404a57f6b0c02e9bb5c1e8c0c285a577d89a5801c60face4ebf1cee334d6be346c240f09ad
SSDEEP 1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P7C:fwUQC5VwBIiElEd2K57P7C
TLSH
T1D5B3B931457E36BF26E93EE828CF1511B84F3912664895D4ABE1FE2C4845E68633CEF4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 85da5d101c008762046da9670ca95944217bbb1829e60a748f367ee4f9926b13
MD5 ef105d8d3e87a813544857290c28833d
SHA1 bfe7010cf80fb8cbcb9eeb5e0d0b551ece0b3134
SHA512 ae71c302652e2de890fca25723381f403f4f9ee51e2da6583977318de3e7ff00defb73b202e17a287def3ff618de86c0af96c0fca7729ef3efe0a4ba3cfdfc63
TLSH
T16FD0803377C9A100F6567375F413C7412F27057415868613A168C45CDC784C557C92C7
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 98eae6fcc56d922689f3a45ab65635857e6510c437555d4eae3a6cd68dff3acb
MD5 338a3c92e96cad1510815c958fc76de7
SHA1 e1234ace09aad728f9bde0798e2fb22ee82583de
SHA512 e29c9087bb4c9c94c8525a95c307117f14827336de29aa01f837bd02b05b3aecd1c1771970519a60972a1495e05b4f68ab34cf5e4ec9d7060f6383ac019c2ed7
TLSH
T17DD0803337C9A500F6567375F412C7412F2705741586C713A168C45CDC794C557C92C7
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 4KB
SHA256 887430eb393c324a7e9dd4122af1c4eec97c5e2fd3023639518c5782ce4b0b34
MD5 5bec74dc72e5cf172cad4c2e37b5643a
SHA1 6cdd92e4730c04be669e84e663e1f7bb432f97b3
SHA512 9ebe146ab7728974d43f496d763614626b08091f474c46756556023396efd7a0b7406c87632abbe5eb99aa0b725a69f1fa106d49cc9ff0c105f1fc97e0cea866
SSDEEP 48:PSD9UCm1usWqcjkfSaADE3LunuQyJ1MABxsXTSDhxoweqGqH8fApmZqlIWuYtjik:297j1AKaXuy11yP6CXnV5Ab
TLSH
T19E91A408095BAD5DDB2CADBAFBC1C64F343E45495A6B8DCB101AD8BC04067DFC5E89D8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index~RFe5857c0.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe5857c0.TMP
Size 3KB
SHA256 a8ab9b173d95e4246ae306f3bfdb6180dc5c19eb4bca9997065435ed5a3408cc
MD5 e33a22c8883d3fe29c5e23aa2430437d
SHA1 bde132cddd0a520480e54f1ec2abb36e1185fb69
SHA512 e1b01d854b1462117ea2317ccf730a90b41bc5692d3a2f87d13b4a20a65012cc47c17824623e56e151ab0d40315c31872773bcf4d20f973716232db81120a09b
TLSH
T16E614D08015F6D6EE32CADF2F7D1525F747D818A89AB0ECB200088BC190ABDDC679DD8
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 1KB
SHA256 1fd19616203992fd8c0c0e8df62c2a46ff8c928a58402eb84d5c09c489237c6f
MD5 eb4ca92a8518aeb2fba4a1660b9f5eb6
SHA1 34e14327f80c794329bd51e6d5ce83b88f5d4b47
SHA512 1f08af2850d5506e8a6d87c446fcc2678e9fb788d43ac3673584f43e849600139a1d1e591adcbf8561cffec4fd2a6a9db1ca7cd59cf30c33a55bf83dd36df7aa
TLSH
T1CD218AF383E1C96E9E0156F49A14AE1BCE6C0615431C7C298AD4AF17D3E3466E002A9B
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 5633feff5a775fa2cc54d9337f3ffe83236da9619ab563fc8d35c678483f32d2
MD5 6c80a8b446ffa703741c79cccde7a8b6
SHA1 f93b4c0419933b0a4782fd5c9f81e39e46b29b97
SHA512 4a3c66b9b31a4924927568ddd80a46ab2b0e6e4667782b5ae28d1e3dafc6aff2f14f4a69039592147fcfcc791cf1afdb85a6214029ef0ed572267ccbe9ceda33
SSDEEP 192:sxZRR8yM/jK1Ml8Mkw/fzs209Idp/fiHW6+WNr9y/Y4Zv0JIgrJ:sxZR+Mw/fzs20+/6Hb8/I9
TLSH
T16742E911AA34697BCCDBD20DF955BF53D6F51572A2900E44ADFCCA1C04E6AEC221782F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 b2a4616c371809a359e412a7f9c698baea9dce17a8207401920d86963f7c05e9
MD5 8c4f90d9284da39ed670a3ac22ad9cff
SHA1 2cc6a8984c65cda378c336bfded0dbd93693d5e3
SHA512 059302b8a93a1730070665305b111d59b39e854f95dffaf1b3f911c596f0d5c4677c61b444118c2091f191197b7cae12a9ac8d6b1b8743948b602b50b2f74044
SSDEEP 192:sxZRR8yM/jK1Ml8UQDkw/fzsEr9IdphfiHW6+WNr9y/Y47o0JIg5UJ:sxZR+qow/fzsEr+h6Hb8/H+
TLSH
T11852E911AA345A7BCCDBD20DF955BF53D6F4547292900E4469FCCE1C04E6AED221382F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 30KB
SHA256 d8f0445bb65820ba8402dcf8318a2feaf67f3458872bf9b961218b9557a7c5b4
MD5 7ccb900a3fe80406880bb4ae505646e9
SHA1 410d970fc19c05d54ccea59996ff84636e85439a
SHA512 8a9100faa6d9f4383d1e37c228f523392790decd2bd1b7420f402c915039e0aff8d4933f71f1759d49eecc88d9af6350bd7296f0ce8f2c1120c626c7a22d61b3
SSDEEP 768:7b8iJPNWvx76r8F1+UoAYDCx9Tuqh0VfUC9xbog/OVsALl6opdgroJkfUno:7b8iJPNWvx76ru1jahALocdreUo
TLSH
T1E7D20A3B680CCB7E4F844E9CEC266F966DD801CB5B988D5447FA884C03C76EA51279DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 9aa28a12868e7e5f27f7d743edbf885649415c2732f85e2b514e16672b4289df
MD5 864a596c7c201cbcf9f86af251055ec7
SHA1 12a52708c5db5e7a32f8fb230d6d4f2b355fffe3
SHA512 396fc7e7b9b71720dab1f65a7051fe19741b2f6cb5d97cb2ead6fad500a18d9029310296a5cee9c461add7ad266dec230c06122fe2286759e207c50e91b9911a
SSDEEP 24:KdDf6ZQaVdJ5J49Z+EIjFJKiWhaLJ1EDZSmLMO8Z6yXYRfcHuaLdzfn43b++Ij7i:Kc0I7KVScvyBOIXKnqAHOIXK3qoHyT
TLSH
T1E591501175BB42423DBD281892A0A72B5742B5E33518E57B3FA810B60F66E380EFD8DD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig~RFe58ebb3.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig~RFe58ebb3.TMP
Size 3KB
SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
MD5 904e6e94a1d46374c8630cfd86cc729f
SHA1 e1d9c3f7813878acc6510d48d95b2bf48b2e1a0d
SHA512 081e2a26252860ff8d8f7a9d0378ae56f0cc50574d13d2a121afdf74284963747ef874a4d73b1df7774cd8570972f4f513eefe0a0325fd088556d5b1ba946712
TLSH
T1DB815C4FCC0CBE77ABAB6A719A35D6B2F79131EA94518A977F8C444EE3050ED0242E50
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 14KB
SHA256 ff5b1b5a1f284c3586e8ffcc53949aabbbf6529489342f02b3fc93f3eba9f7f4
MD5 748607371ad95189260b6744924df51a
SHA1 6d316e08ab41218f153637ea3a86b1dfdf2a9c07
SHA512 e31da9a7161be6a8bab43f7cd51e4f6578996f33285f38e4b2e0ff7b3f62ac8b786c08f49d8bbf53598395c957b54e6c618695fb8614adce70ac758ccbfd0ca2
SSDEEP 384:xsNYIfpGGikl4/kmKSNxuvzxV+MhdpMG8X:xr5rtN4184pM/
TLSH
T1CE624B71BCA86CBB9DA3A141F48B36135F74906BDB886F94D9DC5F1C05DA288130BC2A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 18d1f86592db66e1ae74dbe2bc2f3b8d8bd7489ccfb7c950035165347e0fff84
MD5 74f924cc24f6f227bbe377b651b777a6
SHA1 414c2cb58e8a3396655995c3ca3ce6ef4a0f11ec
SHA512 6490afc8a61619b82f77525ac11a80366979d84ab36e36418465d9dc1ae2c55140d224fba3f5f7ae4b5364d80a5e9ffcab9dff8f2fb9293297c55fed04ee2668
SSDEEP 384:OZcIhsNYwfpGGikl4/kmKSNxuvzxV+MhdpMG8wov:shT5rtN4184pMYI
TLSH
T101826D716CA86CBAACF7E141F88736134FB4D067DBC85F84D4D8AB1C05DA295171BC2A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 26KB
SHA256 703c2685a337f68fd707a774cf1940ce4b9c0dce4bfde38fd552fe55a9a37725
MD5 f0663fa02106afad38f88a81b674234b
SHA1 1d8fe9c56519ced3e623ec4ca3898a85501fcc02
SHA512 6275da275f0dfbea0d96e5b095744752eab6b53afb4ebc8449b3b0aab8b03dbc0ba4f724431066f0d5b852ef9b0298c521b9a165e8b419ec97a6672217760ec3
SSDEEP 384:uiFiZcIGsNI8TUNTUlIlFfpGGiklr/kmKDNxuvzxV+MhdpMG8wov:FFQGxwgY5UKN4184pMYI
TLSH
T101C218F258D7987AE8AE9743F77E2E034E7CD067B5849A50B7885A0CCC961BFC306815
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 ccc6f22ff17da4bc4b93e589ee97523945c17199ba42fa5c9ec7501568ff46dc
MD5 c5ca003a7d4d3179dcdb9c9633a52b4a
SHA1 1f2aaf2b0a2421f2c0c6bec0af09227c004aee62
SHA512 a2a1bc1e87b7509fb2b15b6460893c4596ca678e3a18d2064ab00002700145713bfc480302c9bb5f1f1589f20a1f7427a5de7ec0d607a5fe7aa06e308aedde65
SSDEEP 96:ZqONkhQsjpfmUTmDK5ih/cIPURHl8h4otop5F5DRBhPwivh50xy0SFYKHAxEYe31:gONp6kDfQmiUyXnZ903cmxQiOo8U6
TLSH
T1DE02F9346C786CBB9EA3AE49F48777175FA5212BEA852F84D9E41B1C04C764C1702837
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 15d8786ba5b039fb0faaa26a1863f3d140a25f9410e70bde7f8147f940acdcca
MD5 fb31db9d5c85fb9bdfc4dabc9be58c14
SHA1 d80bd0ad88ec28cbdbeace6473b6d5db5efa4804
SHA512 23b65f268e8a2e5954af6743a49c3a6f8c12e77c2f360d13e1ee4229ed4533a5f1585fa4411aa4d5da2291c48da5ee70103d777c533168e6f5cbfa3647a677a6
SSDEEP 384:cZcIhsNYFfpGGikl4/kmKSNxuvzxV+MhdpMG8wov:Kh+5rtN4184pMYI
TLSH
T12C827D716CA86CBAACF7E141F98736034FB4D067DBC85F80D4D8AB1C05DA299071BC2A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 9ef660f2da5286d376b9b9058f7fae618e7ba81b6b9b4836d82eab9d6e2656cc
MD5 b2f4230389e5bb4ae01a7325de062ef9
SHA1 504d569326e57814e37c0f7da4981e1a3c8d2510
SHA512 0ed3903a844a8ae4d3b0fdd4e976f3bfd777e9e289b3a2631330f8a6b0d2eb9940a44a0bed9caa34e89e87d98cd62a3b2538cae792b32030b78e9a67bba085fc
SSDEEP 96:KqONkxQsjpfmUTwK5ih/cIPURHl8h4otop5FxpDRB9Pwivh50xy0SFYKHAxEYe3s:BONR6kxQmiUyZnd903cmxmFxcRnqqU6
TLSH
T106123A31A8A87C7B9CE3A981F48736135EA55127DF886FD0D9DC2A2C05DB29C1307827
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e865090d-1d07-49f0-a716-e4fd1f5edcd9.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\e865090d-1d07-49f0-a716-e4fd1f5edcd9.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 76d29a1dfc83a977576ec9cbb65391b700ee20020fbb1f273d147133a2918bc5
MD5 56c662c37348d04ab84f1ad0db90a69d
SHA1 7a03f2d47ab02af3bedfd5e85ac6b59750f67a74
SHA512 5553d51a2f496b5cfd4f1fa6c2fd368ccdb0593957f813d288fc65939307dccef124ed815f8224e6499c642c477e04603dad75b19ff2b32c9ae1fbb148afae9c
TLSH
T14841489CA6FA1148B3B7AE5AABF3996D447A78372E46D56D10100D4E0627B40C8B2B33
MD5 SHA1 SHA512 TLSH

Submit Download