hxxps://accounts[.]nvgs[.]nvidia[.]com/api/1/message/VerifyEmail?q=eyJhbGciOiJIUzI1NiJ9[.]eyJtZXNzYWdlSWQiOiIxNTQ2OTQ2ODY2NzQ1Mjk0ODQ4Iiwic2UiOiItIiwicmVkaXJlY3RVcmwiOiJodHRwczovL2xvZ2luLm52Z3MubnZpZGlhLmNvbS92MS9uZmFjdG9yL2VtYWlsLWF1dGg_Y29kZT1UX1VncUhOVldoc0g2Wm9aQWZjQkFVTXJzNm5WVTlJazlrLTJsazZfcm5RWHFaRG1NRTZqdnB6RnZUcy0wTUFPLk1UVTBOamswTmpnMk5qWTJNVFF3T0RjMk9BPT0mdGhlbWU9Tm9pciZsb2NhbGU9ZW4tVVMiLCJpZCI6IiIsImp0aSI6IjVkZjdkNGFjLTZjZjAtNDc5Yy1iYmVhLWFhNmNhM2JmMWZkMyJ9[.]gaFkcAvnfVjpf-ojYhLDusbNL976S6FxU9rtuxpt3IY

Analysis

max time kernel
148s
max time network
152s
platform
windows10-ltsc_2021_x64
resource
win10ltsc2021-20260513-en
resource tags

arch:x64arch:x86image:win10ltsc2021-20260513-enlocale:en-usos:windows10-ltsc_2021-x64systemwindows
submitted
08/09/2026, 18:15

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://accounts.nvgs.nvidia.com/api/1/message/VerifyEmail?q=eyJhbGciOiJIUzI1NiJ9.eyJtZXNzYWdlSWQiOiIxNTQ2OTQ2ODY2NzQ1Mjk0ODQ4Iiwic2UiOiItIiwicmVkaXJlY3RVcmwiOiJodHRwczovL2xvZ2luLm52Z3MubnZpZGlhLmNvbS92MS9uZmFjdG9yL2VtYWlsLWF1dGg_Y29kZT1UX1VncUhOVldoc0g2Wm9aQWZjQkFVTXJzNm5WVTlJazlrLTJsazZfcm5RWHFaRG1NRTZqdnB6RnZUcy0wTUFPLk1UVTBOamswTmpnMk5qWTJNVFF3T0RjMk9BPT0mdGhlbWU9Tm9pciZsb2NhbGU9ZW4tVVMiLCJpZCI6IiIsImp0aSI6IjVkZjdkNGFjLTZjZjAtNDc5Yy1iYmVhLWFhNmNhM2JmMWZkMyJ9.gaFkcAvnfVjpf-ojYhLDusbNL976S6FxU9rtuxpt3IY
Sample260908-wv61mswerd

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
3600	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134333649510039191"	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1108628292-2849104889-3743975892-1000\{5BDFD654-D6F4-4709-8265-20CCED8E8EA9}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2148	msedge.exe
2148	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
4228	msedge.exe
4228	msedge.exe
4228	msedge.exe
4228	msedge.exe
4228	msedge.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
4228	msedge.exe
4228	msedge.exe
4228	msedge.exe
4228	msedge.exe
4228	msedge.exe
4228	msedge.exe
4228	msedge.exe
4228	msedge.exe
4228	msedge.exe
4228	msedge.exe
4228	msedge.exe
4228	msedge.exe
4228	msedge.exe
4228	msedge.exe
4228	msedge.exe
4228	msedge.exe
4228	msedge.exe
4228	msedge.exe
4228	msedge.exe
4228	msedge.exe
4228	msedge.exe
4228	msedge.exe
4228	msedge.exe
4228	msedge.exe
4228	msedge.exe
4228	msedge.exe
4228	msedge.exe
4228	msedge.exe
4228	msedge.exe
4228	msedge.exe
4228	msedge.exe
4228	msedge.exe
4228	msedge.exe
4228	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
4228	msedge.exe
4228	msedge.exe
4228	msedge.exe
4228	msedge.exe
4228	msedge.exe
4228	msedge.exe
4228	msedge.exe
4228	msedge.exe
4228	msedge.exe
4228	msedge.exe
4228	msedge.exe
4228	msedge.exe
4228	msedge.exe
4228	msedge.exe
4228	msedge.exe
4228	msedge.exe
4228	msedge.exe
4228	msedge.exe
4228	msedge.exe
4228	msedge.exe
4228	msedge.exe
4228	msedge.exe
4228	msedge.exe
4228	msedge.exe
4228	msedge.exe
4228	msedge.exe
4228	msedge.exe
4228	msedge.exe
4228	msedge.exe
4228	msedge.exe
4228	msedge.exe
4228	msedge.exe

Suspicious use of WriteProcessMemory 30 IoCs

description	pid	Process	procid_target
PID 4228 wrote to memory of 2212	4228	msedge.exe	84
PID 4228 wrote to memory of 3488	4228	msedge.exe	85
PID 4228 wrote to memory of 3600	4228	msedge.exe	86
PID 4228 wrote to memory of 3488	4228	msedge.exe	85
PID 4228 wrote to memory of 3488	4228	msedge.exe	85
PID 4228 wrote to memory of 3472	4228	msedge.exe	87
PID 4228 wrote to memory of 3472	4228	msedge.exe	87
PID 4228 wrote to memory of 2988	4228	msedge.exe	89
PID 4228 wrote to memory of 2988	4228	msedge.exe	89
PID 4228 wrote to memory of 2988	4228	msedge.exe	89
PID 4228 wrote to memory of 4136	4228	msedge.exe	90
PID 4228 wrote to memory of 4136	4228	msedge.exe	90
PID 4228 wrote to memory of 4136	4228	msedge.exe	90
PID 4228 wrote to memory of 1672	4228	msedge.exe	92
PID 4228 wrote to memory of 1672	4228	msedge.exe	92
PID 4228 wrote to memory of 1672	4228	msedge.exe	92
PID 4228 wrote to memory of 5008	4228	msedge.exe	91
PID 4228 wrote to memory of 5008	4228	msedge.exe	91
PID 4228 wrote to memory of 5008	4228	msedge.exe	91
PID 4228 wrote to memory of 1596	4228	msedge.exe	97
PID 4228 wrote to memory of 1596	4228	msedge.exe	97
PID 4228 wrote to memory of 3192	4228	msedge.exe	98
PID 4228 wrote to memory of 3192	4228	msedge.exe	98
PID 4228 wrote to memory of 2716	4228	msedge.exe	100
PID 4228 wrote to memory of 4324	4228	msedge.exe	109
PID 4228 wrote to memory of 3956	4228	msedge.exe	110
PID 4228 wrote to memory of 3460	4228	msedge.exe	111
PID 4228 wrote to memory of 2788	4228	msedge.exe	112
PID 4228 wrote to memory of 2788	4228	msedge.exe	112
PID 4228 wrote to memory of 2148	4228	msedge.exe	113

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://accounts.nvgs.nvidia.com/api/1/message/VerifyEmail?q=eyJhbGciOiJIUzI1NiJ9.eyJtZXNzYWdlSWQiOiIxNTQ2OTQ2ODY2NzQ1Mjk0ODQ4Iiwic2UiOiItIiwicmVkaXJlY3RVcmwiOiJodHRwczovL2xvZ2luLm52Z3MubnZpZGlhLmNvbS92MS9uZmFjdG9yL2VtYWlsLWF1dGg_Y29kZT1UX1VncUhOVldoc0g2Wm9aQWZjQkFVTXJzNm5WVTlJazlrLTJsazZfcm5RWHFaRG1NRTZqdnB6RnZUcy0wTUFPLk1UVTBOamswTmpnMk5qWTJNVFF3T0RjMk9BPT0mdGhlbWU9Tm9pciZsb2NhbGU9ZW4tVVMiLCJpZCI6IiIsImp0aSI6IjVkZjdkNGFjLTZjZjAtNDc5Yy1iYmVhLWFhNmNhM2JmMWZkMyJ9.gaFkcAvnfVjpf-ojYhLDusbNL976S6FxU9rtuxpt3IY
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4228
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x260,0x264,0x268,0x25c,0x308,0x7ff81122c188,0x7ff81122c194,0x7ff81122c1a0
  2⤵
  PID:2212
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1868,i,6996736324987447782,17265395450656498610,262144 --field-trial-handle=2272,i,3055814507179528063,6501204202256831762,262144 --variations-seed-version --mojo-platform-channel-handle=2268 /prefetch:2
  2⤵
  PID:3488
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2000,i,15957014809844491584,13829226192278238136,524288 --field-trial-handle=2272,i,3055814507179528063,6501204202256831762,262144 --variations-seed-version --mojo-platform-channel-handle=2364 /prefetch:3
  2⤵
  - System Time Discovery
  PID:3600
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2508,i,4724233991253361146,12691576196852198172,524288 --field-trial-handle=2272,i,3055814507179528063,6501204202256831762,262144 --variations-seed-version --mojo-platform-channel-handle=2512 /prefetch:8
  2⤵
  PID:3472
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3452,i,12016245927425090390,9611548999275390177,2097152 --field-trial-handle=2272,i,3055814507179528063,6501204202256831762,262144 --variations-seed-version --mojo-platform-channel-handle=3476 /prefetch:1
  2⤵
  PID:2988
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3444,i,15593170434036217711,4493139923805693424,2097152 --field-trial-handle=2272,i,3055814507179528063,6501204202256831762,262144 --variations-seed-version --mojo-platform-channel-handle=3472 /prefetch:1
  2⤵
  PID:4136
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4204,i,16280210357124956156,5316531293127185969,2097152 --field-trial-handle=2272,i,3055814507179528063,6501204202256831762,262144 --variations-seed-version --mojo-platform-channel-handle=4216 /prefetch:1
  2⤵
  PID:5008
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4244,i,13595842400929027460,13395787032083096318,2097152 --field-trial-handle=2272,i,3055814507179528063,6501204202256831762,262144 --variations-seed-version --mojo-platform-channel-handle=4276 /prefetch:2
  2⤵
  PID:1672
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5200,i,7242183030916436408,17928254574187399726,524288 --field-trial-handle=2272,i,3055814507179528063,6501204202256831762,262144 --variations-seed-version --mojo-platform-channel-handle=5292 /prefetch:8
  2⤵
  PID:1596
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5196,i,17541537093424931281,15460389338414360878,524288 --field-trial-handle=2272,i,3055814507179528063,6501204202256831762,262144 --variations-seed-version --mojo-platform-channel-handle=5232 /prefetch:8
  2⤵
  PID:3192
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5872,i,13934544226392731619,1525983475625519220,524288 --field-trial-handle=2272,i,3055814507179528063,6501204202256831762,262144 --variations-seed-version --mojo-platform-channel-handle=5888 /prefetch:8
  2⤵
  PID:3476
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5872,i,13934544226392731619,1525983475625519220,524288 --field-trial-handle=2272,i,3055814507179528063,6501204202256831762,262144 --variations-seed-version --mojo-platform-channel-handle=5888 /prefetch:8
  2⤵
  PID:2716
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4252,i,9540617491393362767,12275805848085257422,524288 --field-trial-handle=2272,i,3055814507179528063,6501204202256831762,262144 --variations-seed-version --mojo-platform-channel-handle=4392 /prefetch:8
  2⤵
  PID:4324
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3680,i,8833129314624180467,9004603636524264726,524288 --field-trial-handle=2272,i,3055814507179528063,6501204202256831762,262144 --variations-seed-version --mojo-platform-channel-handle=5964 /prefetch:8
  2⤵
  PID:3956
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4288,i,5322644840911858023,16540871975378741397,524288 --field-trial-handle=2272,i,3055814507179528063,6501204202256831762,262144 --variations-seed-version --mojo-platform-channel-handle=4380 /prefetch:8
  2⤵
  PID:3460
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5340,i,12340748700416309305,8322440024381610860,524288 --field-trial-handle=2272,i,3055814507179528063,6501204202256831762,262144 --variations-seed-version --mojo-platform-channel-handle=6220 /prefetch:8
  2⤵
  PID:2788
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.4355 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=768,i,5969085613454609546,14630809358238519368,262144 --field-trial-handle=2272,i,3055814507179528063,6501204202256831762,262144 --variations-seed-version --mojo-platform-channel-handle=6088 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2148

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:2312

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 67c3d537374abf4a4065bd49eb5e79e4d5afe358a5731186278c6aee60766d9d
MD5 4e493aa418041fca5fa30fcbfdf660dd
SHA1 ea939d51c02b7420c2eb0e8a20246e28cd7e7c4b
SHA512 25c896cd04f1a8a5daf896cad6530f5a015265fc30399b7facf3a6fc2016b03aaf4a88ce889166d73a86b0b17a17d7512d0edca0d80e9707d3e081708a5000ce
TLSH
T18CD09B20768D5043C59133B398455F45165D596815569141A434514CDAA5044E36654A
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 4KB
SHA256 1496e649ac0d2669e4b07f2c3e6a374e92164218aa6c27234bc89f1b60acad6a
MD5 9aaf79b30e66b70957e41038e146a082
SHA1 e9e113e3e57aacd0db8adb836ba231818c5c7d55
SHA512 4daf1d4dbe37ee7bb113189d4d4a22f5f39117a2f57fa65eeb96c858e6c7be12ba924443c83c8d0834530ba0ccf696d56686fdc125da4e00e12590a91541dd67
SSDEEP 96:M4ce4RoMd1sBHvcZ0QuT/mdfQtoHHcTB6g:sekd1slcPg/mdfQtoc9z
TLSH
T1E2A14D240DC6C1E0D7D1C071A5F1A34A707ACBBFEE1F1E921B618E76B7943E6A4898C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 1KB
SHA256 e7c94f405794b17b06655957b661b7ca2f9a907f71c58e4deaab998026997c7f
MD5 68fb86d6901b01848171f6a7bb9fac77
SHA1 5fec25a5b841a174a2eb92f3fe1b681d3c178aad
SHA512 4676c66d4b2d8f84589ee8aee8d6a1b461167004512c45b58e6551b45df12a3e6373a18f5b31010bc3af2a777c0b1af6f33d187df006c85b430bc1a799e61487
TLSH
T1C2215AF383E1C96ECE1556F4AA14AE1BCF5C0615431C79298AD4AF17D3E3466E00269B
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 10KB
SHA256 998f10b5acbf09cc7ce2e6e169f81147b072dfbbaabeafc89ee7e6cb75b5663c
MD5 8f4c159997639654ecc843df5433c533
SHA1 ab252fed4b9d547fe7ad0ef102c36669e023a493
SHA512 76add404dd5a918f0a11653adca6d7197f7fe22c1930d5388888b19106c7ec3508e42b92dee198d5964d62cf7722f6ac11316ed8b074b98f10b105e849d95fc0
SSDEEP 192:sxZ3RVkI/frsTl6cIdp/f2HW6+WNrok/Y4XW29IgrJ:sxZ3UI/frsTl6F/uHbn/59
TLSH
T1A022C9526E38A97B8CCBD20DFA55BF53D6F9503291D05E48EAFC861C04E6ADD220780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 10KB
SHA256 a8b25885608594b7f10bc457ca5b1ab79e8681d5c38c668da4ce52576f110b63
MD5 bfc720d1cd71a8f9e8fc5340cdeb7abd
SHA1 12cd5bc9751e5b4363701e61880edcfe21a21759
SHA512 29ad63d0375a875e0a536de75adc6720e61d22960b2286a73ede79d53c8c6278a1cae582db405ec580fb2e3edf58a3bd173f541b32219d5f3cd841d9293a1203
SSDEEP 192:sxZ3RVkI/frsRl6cIdp/f2HW6+WNrok/Y4XW29Ig5vJ:sxZ3UI/frsRl6F/uHbn/5z
TLSH
T16022C8526E38A97B8CCBD21DFB55BF53D6F9503291D05E48EAFC861C04E6ACD220780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 10KB
SHA256 3352884bf7d44b6c6b3c3d65ba386a126d3305ee793077234b0413925025e744
MD5 02272c6a5f3d6d4235318450b3a3695e
SHA1 94eb8f27195a4cfe3592724eb2a980c1cf9bb067
SHA512 16310dee7e628b80772c32829d6048fe502ab0131fca6cd4b11e74ceccd156cb0871ce117ee93f6ebb124ce837bd797dd1b649013f9a46ab6c531aa002fe58d4
SSDEEP 192:sxZ3RVkI/frsRp6cIdp/f2HW6+WNrok/Y4Ay29Ig5NJ:sxZ3UI/frsRp6F/uHbn/il
TLSH
T1F632DA516E38697B9CCBE20DFB55BF53E6F9503291D05E48AAFC861C05E7ACD220780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 27KB
SHA256 3620f691c02e5ab12cd84f4372717ccda623915e20ead98b8c94a52432592182
MD5 29993a3d802d2842a0030885bb6d6ac2
SHA1 ee1f49c021d24489229f73942803502ea20c3216
SHA512 dc8bdf68521fc7401dc9e2c4b917ff104257d92d6e39ec5e42875cd049e9e7368508d8d285842a9fc4bfbb54e17ed01d5630d4ac71ae3fcb6a1af5318a80237d
SSDEEP 768:7lqPALKWvWep58F1+UoAYDCx9Tuqh0VfUC9xbog/OVqqLlBHu7Qrouj7:7lqPALKWvWep5u1jaHqLXO77e7
TLSH
T16EC2E92B644CCB7E4FC00A9DEC5A6F972E9802C7A7588D4047FE954C02D77EE912A4DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 3adaa815a4e3b407e9b7bc7daf46a284cc81cd9986df986d0090f4f06a44b71e
MD5 8ce8f37c8c2d4172b2df90fc33d15dc2
SHA1 d04be764f3a7d87a1e6da9848c09a13dc8447798
SHA512 a943b36542200e282301c2694d8a118d114fccbdd70dbf43f804392e9f442f4d3dc84a62050f89dc17df21f5df72b6fb0c62294c03d73f056e0c5d8f8f9d8aff
SSDEEP 24:KdwfXE1a6diie4yu+FIj4eKiNhaGe1EQOSmkMN8I/yXY7fiB4addRxh4VR+8IjNJ:KQBIdKCQgvyBEIbKZ6sJaIfKzycjye
TLSH
T173912251743616473C7E3848D2E2AB2B1B8135A77058E6BF7BAA00B50D26E290EFC5CD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig~RFe593762.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig~RFe593762.TMP
Size 3KB
SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
MD5 904e6e94a1d46374c8630cfd86cc729f
SHA1 e1d9c3f7813878acc6510d48d95b2bf48b2e1a0d
SHA512 081e2a26252860ff8d8f7a9d0378ae56f0cc50574d13d2a121afdf74284963747ef874a4d73b1df7774cd8570972f4f513eefe0a0325fd088556d5b1ba946712
TLSH
T1DB815C4FCC0CBE77ABAB6A719A35D6B2F79131EA94518A977F8C444EE3050ED0242E50
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 26KB
SHA256 a86c4fb15cc132a21e422fe7988a2400e55741e8acaaf7a1103bcb5a9389363b
MD5 d9d2cc4ba3b0d29884dfa4fea1656bb7
SHA1 98176a77e83ee4e8e79db70344abd649ea0089eb
SHA512 0b7c5589e11d326b1827991c6ed99ac4ab5407a8fe827d9c86daf2c8760744bd7739126f1a2f5897a90ac9d33a940635a01e6d97a84998a2489a87c30d54d874
SSDEEP 384:OiFiZcIqsNB8TUNTUlIlkuU6YRsVXq6VOElcjHJQOxuvzxV+MhdpHGzWoT:lFQq8wgG32bOGCpQO4184pHZc
TLSH
T148C21AF258D7987AE8AD5743E77E2E034EBCD067B544AA40B3985A0CCC961BFC30AC15
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 6315481814b04b134bf12c2923662dd0d8125a769df45a674ef7ef96b5d2faa8
MD5 3c125c235abae891477d455d13155ab7
SHA1 23d51fb0a8925a7c5b51f7fefd32f03a43f12168
SHA512 053b3feab507f6eec9bbbdd089e73c653be77985002a32282de9fb90f60ecce939c241d89c533ecf364a16e609d6144d6e99b1b2f0d4b7b2c4faf3596b9c9132
SSDEEP 384:9ZcIhsNfkuU6YxsVXq6VOElcjHJhOxuvzxV+MhdpHGzWoT:lhVz2bOGCphO4184pHZc
TLSH
T149825D716978AC7B6CE9B245F48737035EB89067D6C86F80D5ECAF1D01DA2A9030ED27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 76f432b4f11a58121491bb6ee6c90b84ecb259e362c45d6b68b07f472d2592be
MD5 d5784930d2d1ac33f68d2775b2c89d8a
SHA1 25d6a02476bd03cf920570e27f83bd75ee60cefc
SHA512 59164dc549273f68ea6aa9538a517d3b1e445df630029c20c7dfeea0f7007423b25bbd906ccd93e6de275275e4595f58b52eb59dd75c8687952d1adadd684139
SSDEEP 192:mONf6rvoQmiUyYKzDrKhD4XqMB/1jnOBuURYcjHpExS9U6:mONf6cO+6Xq6VOElcjHC2U6
TLSH
T1BA02F935B9686C7B9EE6AE49F4873B135FE4202BD6856F84DAE81F1C00D725C130A937
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 6626e8cbf2ce161a2b533dd59075ac6deefc10d6dbf86791b23900b01261e801
MD5 8b7a6fa34faf9a0e7baf9661f3147b09
SHA1 96357e5baddfb858d1e70ad9c039f71e848ad415
SHA512 a7c9b4774577dc642370c074495b05415ea47674849594d59d87ee46bc876ff1e72b8b5b26cc610599bad3491e1bf8ba1cdaa20387b1cc092d944ad7dcf718e2
SSDEEP 192:0ONa6rvjQmiUypzD8hD4XqMB/1jnOBuURYcjHJvICrqLlU6:0ONa6Bg86Xq6VOElcjHJ3OU6
TLSH
T12012F936B968AC3B5DE2A684F08736035E955127DA857FC0D6EC2E1C01DF66C530F927
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\metadata.json
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

fdc6eb8c-f4e7-42f0-b408-fb281d6ed9f3.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\fdc6eb8c-f4e7-42f0-b408-fb281d6ed9f3.tmp
Size 18KB
SHA256 a6b68737f05190814104e3cf32b334e652a50926cfa18b6a229998ba17d82fc4
MD5 7e5f8367ae9393802dfbce64273e3145
SHA1 eaf6ec75763f904d3cb3529e9cfb3ac6522f23f0
SHA512 de3f35536314e2536e262ff974092d6ca56e60eca10da4465bfdd89c45917ff0719a24716850093f29f344f565977771a600eae5b16080a0ffd5ebf1f0cb0e93
SSDEEP 384:FZcIhsNfkPU6YxsVXq6VOElcjHJhOxuvzxV+MhdpHGzWoT:9h8z2bOGCphO4184pHZc
TLSH
T1FB826D716978AC7B6CE9B245F48737035EB89067D6C86F80D5ECAF1D01DA2A9030ED27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 5d5a14b69172bd61c0bc402938be8ae0e8593f2d544dbf64efde9f2d97e8dbd7
MD5 ad9278a67f56818c970e06bfde8bc4db
SHA1 84aa8efe997511e298c9d28ab18ddabb10073ed4
SHA512 e2eac631d723cbb0b7576720ec3a08d413ecea9c77c7c8e66764e1b3803bdb6b9ec37f66f5af2b4ceb2c0967d9ee495e2eaeff8ff1acec142238ed146c919c63
TLSH
T12E41FA98BAE91058B3B77E1AABF2A86D497F7C771E07D55D10110D4F0927B40D861B33
MD5 SHA1 SHA512 TLSH

Submit Download