586202eaa5697a83146c2832f2c56c7cd92d8a9e80154127573241557062a13b

Analysis

max time kernel
148s
max time network
154s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
10/09/2026, 03:46

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
http/mosaic.html
Size 2KB
Sample260910-ebzzjsyves
SHA256 586202eaa5697a83146c2832f2c56c7cd92d8a9e80154127573241557062a13b
MD5 39727c66b45b7250bbc85feae3eed678
SHA1 9fa24c34d11e7c7c83631de902089d60581a287e
SHA512 7d0ffb4ae4583912d09501b9deb7b89dafcdb9a618a949631b740d6fb5d1941da29279fc13bd462ace1fdd89e71f93b52294e59eaa104e0edae3141189cc3603
TLSH
T1D041320C888BCEB564200690B492DB59E16EC80EF38CBF6CB15C11FFE61A7E844635CC
MD5 SHA1 SHA512 TLSH

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
3792	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134334856520291411"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-889581200-2041691093-2048517887-1000\{394BEFC9-8207-4A7E-A983-DD1A662D4890}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1092	msedge.exe
1092	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
4116	msedge.exe
4116	msedge.exe
4116	msedge.exe
4116	msedge.exe
4116	msedge.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
4116	msedge.exe
4116	msedge.exe
4116	msedge.exe
4116	msedge.exe
4116	msedge.exe
4116	msedge.exe
4116	msedge.exe
4116	msedge.exe
4116	msedge.exe
4116	msedge.exe
4116	msedge.exe
4116	msedge.exe
4116	msedge.exe
4116	msedge.exe
4116	msedge.exe
4116	msedge.exe
4116	msedge.exe
4116	msedge.exe
4116	msedge.exe
4116	msedge.exe
4116	msedge.exe
4116	msedge.exe
4116	msedge.exe
4116	msedge.exe
4116	msedge.exe
4116	msedge.exe
4116	msedge.exe
4116	msedge.exe
4116	msedge.exe
4116	msedge.exe
4116	msedge.exe
4116	msedge.exe
4116	msedge.exe
4116	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
4116	msedge.exe
4116	msedge.exe
4116	msedge.exe
4116	msedge.exe
4116	msedge.exe
4116	msedge.exe
4116	msedge.exe
4116	msedge.exe
4116	msedge.exe
4116	msedge.exe
4116	msedge.exe
4116	msedge.exe
4116	msedge.exe
4116	msedge.exe
4116	msedge.exe
4116	msedge.exe
4116	msedge.exe
4116	msedge.exe
4116	msedge.exe
4116	msedge.exe
4116	msedge.exe
4116	msedge.exe
4116	msedge.exe
4116	msedge.exe
4116	msedge.exe
4116	msedge.exe
4116	msedge.exe
4116	msedge.exe
4116	msedge.exe
4116	msedge.exe
4116	msedge.exe
4116	msedge.exe

Suspicious use of WriteProcessMemory 30 IoCs

description	pid	Process	procid_target
PID 4116 wrote to memory of 4680	4116	msedge.exe	84
PID 4116 wrote to memory of 3792	4116	msedge.exe	85
PID 4116 wrote to memory of 4712	4116	msedge.exe	86
PID 4116 wrote to memory of 4712	4116	msedge.exe	86
PID 4116 wrote to memory of 4712	4116	msedge.exe	86
PID 4116 wrote to memory of 3672	4116	msedge.exe	87
PID 4116 wrote to memory of 3672	4116	msedge.exe	87
PID 4116 wrote to memory of 2148	4116	msedge.exe	88
PID 4116 wrote to memory of 2148	4116	msedge.exe	88
PID 4116 wrote to memory of 2148	4116	msedge.exe	88
PID 4116 wrote to memory of 4100	4116	msedge.exe	89
PID 4116 wrote to memory of 4100	4116	msedge.exe	89
PID 4116 wrote to memory of 4100	4116	msedge.exe	89
PID 4116 wrote to memory of 3768	4116	msedge.exe	91
PID 4116 wrote to memory of 2772	4116	msedge.exe	92
PID 4116 wrote to memory of 3768	4116	msedge.exe	91
PID 4116 wrote to memory of 3768	4116	msedge.exe	91
PID 4116 wrote to memory of 2772	4116	msedge.exe	92
PID 4116 wrote to memory of 2772	4116	msedge.exe	92
PID 4116 wrote to memory of 4792	4116	msedge.exe	96
PID 4116 wrote to memory of 3204	4116	msedge.exe	97
PID 4116 wrote to memory of 4792	4116	msedge.exe	96
PID 4116 wrote to memory of 3204	4116	msedge.exe	97
PID 4116 wrote to memory of 3192	4116	msedge.exe	101
PID 4116 wrote to memory of 216	4116	msedge.exe	111
PID 4116 wrote to memory of 4272	4116	msedge.exe	112
PID 4116 wrote to memory of 1640	4116	msedge.exe	113
PID 4116 wrote to memory of 4192	4116	msedge.exe	115
PID 4116 wrote to memory of 4192	4116	msedge.exe	115
PID 4116 wrote to memory of 1092	4116	msedge.exe	116

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument C:\Users\Admin\AppData\Local\Temp\http\mosaic.html
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4116
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x23c,0x240,0x244,0x234,0x2b0,0x7ff96502c188,0x7ff96502c194,0x7ff96502c1a0
  2⤵
  PID:4680
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1932,i,5389985598581388235,10261272155332271057,524288 --field-trial-handle=2392,i,1728944041359348990,16093167823642062793,262144 --variations-seed-version --mojo-platform-channel-handle=2420 /prefetch:3
  2⤵
  - System Time Discovery
  PID:3792
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1660,i,1218652591397836965,1080058630763301818,262144 --field-trial-handle=2392,i,1728944041359348990,16093167823642062793,262144 --variations-seed-version --mojo-platform-channel-handle=2388 /prefetch:2
  2⤵
  PID:4712
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2596,i,11203281294682995934,1361692368190323728,524288 --field-trial-handle=2392,i,1728944041359348990,16093167823642062793,262144 --variations-seed-version --mojo-platform-channel-handle=2600 /prefetch:8
  2⤵
  PID:3672
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3436,i,10004354255046791554,5238436575401973600,2097152 --field-trial-handle=2392,i,1728944041359348990,16093167823642062793,262144 --variations-seed-version --mojo-platform-channel-handle=3484 /prefetch:1
  2⤵
  PID:2148
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3456,i,5384442559709050156,3119860157049128849,2097152 --field-trial-handle=2392,i,1728944041359348990,16093167823642062793,262144 --variations-seed-version --mojo-platform-channel-handle=3560 /prefetch:1
  2⤵
  PID:4100
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4232,i,16045902874952760143,8599084464464528764,2097152 --field-trial-handle=2392,i,1728944041359348990,16093167823642062793,262144 --variations-seed-version --mojo-platform-channel-handle=4260 /prefetch:2
  2⤵
  PID:3768
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4208,i,7635281484445441160,8184098746807714544,2097152 --field-trial-handle=2392,i,1728944041359348990,16093167823642062793,262144 --variations-seed-version --mojo-platform-channel-handle=4256 /prefetch:1
  2⤵
  PID:2772
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3524,i,17309495852229169982,15091414731465303716,524288 --field-trial-handle=2392,i,1728944041359348990,16093167823642062793,262144 --variations-seed-version --mojo-platform-channel-handle=5168 /prefetch:8
  2⤵
  PID:4792
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3656,i,5345299462131798621,5823417993372966567,524288 --field-trial-handle=2392,i,1728944041359348990,16093167823642062793,262144 --variations-seed-version --mojo-platform-channel-handle=5148 /prefetch:8
  2⤵
  PID:3204
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5804,i,10465193014836706923,11947176062991983399,524288 --field-trial-handle=2392,i,1728944041359348990,16093167823642062793,262144 --variations-seed-version --mojo-platform-channel-handle=5820 /prefetch:8
  2⤵
  PID:4552
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5804,i,10465193014836706923,11947176062991983399,524288 --field-trial-handle=2392,i,1728944041359348990,16093167823642062793,262144 --variations-seed-version --mojo-platform-channel-handle=5820 /prefetch:8
  2⤵
  PID:3192
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4316,i,4544062468930677108,10391035728608441450,524288 --field-trial-handle=2392,i,1728944041359348990,16093167823642062793,262144 --variations-seed-version --mojo-platform-channel-handle=4300 /prefetch:8
  2⤵
  PID:216
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4304,i,15249533788655559071,4389660077454329600,524288 --field-trial-handle=2392,i,1728944041359348990,16093167823642062793,262144 --variations-seed-version --mojo-platform-channel-handle=5928 /prefetch:8
  2⤵
  PID:4272
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4324,i,7578430917203661109,6377689367811417448,524288 --field-trial-handle=2392,i,1728944041359348990,16093167823642062793,262144 --variations-seed-version --mojo-platform-channel-handle=4284 /prefetch:8
  2⤵
  PID:1640
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6404,i,18263849863111448176,11309276037199620272,524288 --field-trial-handle=2392,i,1728944041359348990,16093167823642062793,262144 --variations-seed-version --mojo-platform-channel-handle=4284 /prefetch:8
  2⤵
  PID:4192
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6080,i,8430735802255760307,13052574554725229229,262144 --field-trial-handle=2392,i,1728944041359348990,16093167823642062793,262144 --variations-seed-version --mojo-platform-channel-handle=760 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1092

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:3836

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 11d3c4c52f9fc9cd2b10a22b48769759f994fd6364f9a0fc145f4cd2c2a22e9d
MD5 4751cf705a737c4226029624bf43b9a8
SHA1 fd8cf726ee3f8f75b97147829de5553530caa82c
SHA512 46e3fedbf7fa14bdc2b3aad129f2879a9d24252f5d7bd9b55766bc32a6b82ea77aaf193bcdbdf4423e3b67ef84955e589b6077609344091ef72204c1d50b0dab
TLSH
T17ED09B307A58A58BD14360F1A4114B4115375557205397757521508E9E98055B3CA057
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 701082e4ac35f878dc5ff6eb27989aae9d20d9b5662643e20b3acd1720b367fc
MD5 2b3686986ce1fd99f079eb226e8b0a8b
SHA1 0d2cdee36351378b91ed7f6ecdb43457fe4d7b5d
SHA512 937da61c495fd21a02bb76a63556dec83ce132f1d1830ff8d9af6212d15f1844766dd4abadd15ea61b48f8ae03b52baca44c99117714c705da840dbff8f116dd
TLSH
T182D09B303A58A98BD54360F1A4104B41153755572053D7757521508E9E99095B3CA057
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 1KB
SHA256 b41c9f38dab62b5164bc31ed9b2fb260f8dd174a8fb6cdb31d75225537917c91
MD5 2df5e5e888f99f0b70f50c88a3672e98
SHA1 8499008b03076c79a83c7b799f84b3743a843122
SHA512 593868467432161f0e9a3a7cdb4083d17bba72a269d2ce06f50ad99d40bd9ac64bffd2e1aef4e40a8dc7ef8548efb22d7821f0ccc4869051996b86d850a91d3c
TLSH
T19041C57816E3454DE3201B7BA4F02E1639F98D953EE36E1D9D4889753A4FB22831F278
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe58a217.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe58a217.TMP
Size 1KB
SHA256 413cdf8affccd5f678c6f68faa97996febc1d4486e7b9c5e35374afe7f4a2c15
MD5 cba44d4eefc187ef22913954e6b22838
SHA1 d74eabe522831514b92b34af628b47bdee799a39
SHA512 4b66343d06f7d28c1abc7c8bf26c16a22822d3fe9a9abd945dd40b3da7ad37e74d357a12649c436f0e61aeffdd97d801645f5a1f8c706274486cb3651d7680c9
TLSH
T10F41E57816E3044DE3201B3BA4F02E1639F98D953EE36E1D9D4889743A4FB22830F278
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

9eee1024-785f-4aa2-8881-09346996c05a.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\9eee1024-785f-4aa2-8881-09346996c05a.tmp
Size 949B
SHA256 8ec619be732a8b5c47d9fbd7171e4b22bb501449907e155fe8665304f5f550e1
MD5 a1f729dec2862a9b209867ed36c29d99
SHA1 4cd355eedb2c625c3c5c23655c82175967a89416
SHA512 8faf3f6477bb413a58ce31ab76b050be01ca0c7b8fdc292e0e8e219e066160c25f961900d9a3ac4838d5c4532f96402df079c5764b1e07a84bfd39c3adbc9c20
TLSH
T1B4117AF3C3E585AE894156F05A24EE2BDE2D0A06822C7C1989D4EF2B93F3075E00295F
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 ffb7d3eb5d6e20b06a3845a51fe146b8f930e34666a5787a4e0d262230772366
MD5 38ed7b973927c2676753761d6b51d854
SHA1 6eae0d48e1d2170453ee6b8c8759e6c21954230c
SHA512 5c07f86e9053a2d29f85f492d27398c4c7ddf19dc1a6c2f6e16dc63ed17db8b5a88977597249a289b8a919b0bda6d79b19ea031b59f1136f27ab937b6382a8b6
SSDEEP 192:sxZ0REHyM/jK1Ml8MWA/fPsFlWIKIdpdjHW6+WNGY9IKNDzIgrJ:sxZ0ODuA/fPsTWiBHbGu9
TLSH
T16F4208116A34A977CCDBD309FA557F53D6F90572A2900E48A9FCCA1C04E6BED221782F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 ccabaa15f0d8f1f91c261c99ce35b75aecf9e830a2638f2233db1868c5cbce0d
MD5 115cba9fcb1414a11cb61f969718b28f
SHA1 2c887be6ba1a7bd8e8047fa7c9d8ee81f1394660
SHA512 cecce4021ab5c3d4e18f4b6d37c3e1a530cd07f4a6852b72461c932ebcbe31f954f95f56c7d4c1052f647dfdbbd3468e71ceada3792ff590595b3148b394dc4d
SSDEEP 192:sxZ0REHyM/jK1Ml8UQmWA/fPsjfiWIKIdpHjHW6+WNGY9I1wizIg5yJ:sxZ0ODqxA/fPs7iWiDHbGt8
TLSH
T1F552F8116A34A977CCDBD60DF9457F53E6F9057292940E48A9FCCA1C00E6BED221782F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 30KB
SHA256 a219816f669b1ef67098d7f07cbc19dad4dd7d784889d170890e3a121de5d345
MD5 5e47ecd853f0b7b85d24af625a4c4902
SHA1 eda365e58b45dc988ad64b41a4d678802b6af016
SHA512 a2ae45231da85ee1a4ba99ef8c9960269874d074d46fb7e9bb37dc94021926ff8fa9ce806df7f599431ab882cc246af648dcac7d796d30a9bb2c7e9c8e350846
SSDEEP 768:y/cv21wWvu+Z+8F1+UoAYDCx9Tuqh0VfUC9xbog/OVjFLlwmWNRrodjg6M:y/cv21wWvu+Z+u1jaeFLeRNqdjc
TLSH
T10CD20A2B280CCB7E4F841E9CED2AAF866DD801CB56988D5447FA894C03C77EB511B5DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 5KB
SHA256 b0674c1eeffdb9bd51cb606eca299c71da886f039736e9b9891c5ecae8ea53e2
MD5 4cbf3cd65964d1b0f3f413290daf84f1
SHA1 ea32531da6e26b32840b9c079cf4082a21900681
SHA512 8981b164ef5e3fbe9e0b6b0c3443a83d756c602fd32f7dc09ede7b3ed3d3fe332874c4faa35fee3e2ce5fa2c7cfe43c2bf3846cd96915fea8c6f480dbe3647d2
SSDEEP 96:KaRklRnHnqlPKZThqKLfTzqHxJSrBDujeKEoeEmsKbSOeDmKoc4:mTtNlThR
TLSH
T179C12157B2370602297D694CA3628A368F4531633814F5EF7BB900A14E6BF225EFC9CD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig~RFe5937fe.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig~RFe5937fe.TMP
Size 3KB
SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
MD5 904e6e94a1d46374c8630cfd86cc729f
SHA1 e1d9c3f7813878acc6510d48d95b2bf48b2e1a0d
SHA512 081e2a26252860ff8d8f7a9d0378ae56f0cc50574d13d2a121afdf74284963747ef874a4d73b1df7774cd8570972f4f513eefe0a0325fd088556d5b1ba946712
TLSH
T1DB815C4FCC0CBE77ABAB6A719A35D6B2F79131EA94518A977F8C444EE3050ED0242E50
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 51f6ee1b140cb9256a40f4e4b2f82651020885e3a134e28a8a6e3fbb5089586e
MD5 0e467374e98bf084b9778cb79ce80602
SHA1 768ef8e5e7e6368ceb396f149455291d59bf4b7e
SHA512 eb47c30b93b010ccf15c0cc2363b4fdb6051d950dffdcb97481a8c6ac42e2197b0d2cd8b5e1c3fcbdc704c17ba4bd7a0b74f0d3378a6fb826a609b40656274fc
SSDEEP 384:bZcIhsNgZrjMSwziUsGue+CnOhiJrdKsa+VYEBZ5oV:DhD8+KvOhihdKhgLn5q
TLSH
T12A828D312D746CB75DA79684F98736039EBC8163E2C96E94C5DCAF1D01DE3A8130AC2B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 21KB
SHA256 d29b21fa4bc86ae109a0343ec780a6d1a6668d149b87fdae2ec3f1ea350a584f
MD5 87e34571922e5c6d73f19f000ef72440
SHA1 c690b3a866d2bf1bf05d22ef94f2751fa4c0ef8a
SHA512 6bdbe485d86e380425f79d5e17724d5dd5e8582eb91150361b76f07efd0e41ed099b268a24899f310716b0e3232c2e94bfb91fd54d9cb5bd1e092a295183baed
SSDEEP 384:bRiFiZcIfsNg8TUNTUlIlKrjMSwziUsGue+CnOhiJrYKsa+VYEBZ5oV:b4FQf9wgg8+KvOhihYKhgLn5q
TLSH
T1BFA26D325DA49D7BADF79B84F94B32038EF841A3D585AA90D6D8AF1D01DB2DC130BC16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 54cf6fcfcb6a4a58f50713adeca6c4506c7dc2f5c7aabaea8f406e269011355a
MD5 493892a2975e4ec8ed146f1d571b4481
SHA1 95d1acfa7c906b457ab65e3f7ab8e5fa496511f0
SHA512 997fa463d4c74387aaf19910b8da0bcd33296d0bb57bcfebe034fcf309c27d97b18394846993006215436e0b509d10965131d612dbed6e1d51ec40bc7455c6b6
SSDEEP 192:JONo6v+YLNQmiUywwXZh+CGKO1m1us6b2U6:JONo6vz/QZh+CnO8o2U6
TLSH
T18402E93579682CAB9FF2AE48F58737179FA8217BE6512F80D9D82B1C01D765C2306826
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 41c51241d1c5d4ed270cb9ae020e794305b9b3c7466db073d5375d148c7b9ab8
MD5 af73fa5396c640903bbd4edadc94838d
SHA1 7fe885f3a261264c06861f0f59a9ae4c5fe66654
SHA512 66c209f2446f17adeb016df748b6ea3ad56f933f7d61cae758bece6be5c360c9660aae88d7a5bc53e7190824117fdfe1b44987cb6cd865daa35bc3b5e9d76d86
SSDEEP 384:ZZcIhsNgKrjMSwziUsGue+CnOhiJrdKsa+VYEBZ5oV:xh68+KvOhihdKhgLn5q
TLSH
T1D3827D3129746CB759E7A684F98736039EBC9163E2C96E94C5DCAF1D01DF3A8130AC27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 0e2ffb0b27fcbe31245d4aeefa9d9cf42679b47a6f0a5b4ed6647569bf8ce889
MD5 54fa0dca702ac831c8ab579b47c4db1d
SHA1 f3e96d17759c7a3f2f731671015a23c217606497
SHA512 e944c32b7dc37cccd3d8a1fb301afa14e7fdcbd210617e0f73e2b8ce36f16d72c74b981010c3dd3128affd301b690155aad7f7a9064109b846d7574816c0df9c
SSDEEP 192:fON56v+YLSQmiUywmXZh+CGKO1maXSJr1CHbq5U6:fON56vz6KZh+CnOhiJrCKU6
TLSH
T1CA121A3178786C7B5EE2A944F48735139EA85167EA463F90D5DC3E1C02EF66C234A817
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\metadata.json
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 0a115fbbbbbee41863c9e7c5d52191ee24cddffd299718c79a56559a7441fa93
MD5 f5de62e9249c424ca081c41b5d8b15a7
SHA1 ce7f9d803f83f178b1053e2aeb82e67dc139777b
SHA512 843df9e196cca715b727a718a8efa7f8e126a9cb839e19f58d493a48a3361a4b408effd461634b9422e2851ce5c837339b0830a3d7bcfaef023bfa4c2e804792
TLSH
T11B411858A7E91148B3776F1A9BF7686E487B79232F0BC49E10110E8F4A22B80D871737
MD5 SHA1 SHA512 TLSH

Submit Download