4eed2e5c29484a2b5e67eb18873c6a8ec130ab922970f60a26469df1895c0968

Analysis

max time kernel
148s
max time network
155s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
10/09/2026, 03:46

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
http/old/admin/index.html
Size 4KB
Sample260910-ebzzjsyves
SHA256 4eed2e5c29484a2b5e67eb18873c6a8ec130ab922970f60a26469df1895c0968
MD5 f9fa96be3f6948ea192ceab819657096
SHA1 9c8e90ab1078db534e13f04e418643601727c93e
SHA512 f5776d8c6ad885fe9adc4d939dfff6520444fc313742979465f71c240fe4ef868e884d0f687f73cac5ebd19aed5afd0ca57c21a4441313284e9b0479da5df3c1
SSDEEP 48:capyeetJCYRsL+RocbkDqvxxJ1jv7q98y298ROZVN:RX8JhTpkDqZ9OV2gOTN
TLSH
T1A6915B22E0D8B12362B74359B1E1AF98EEBD9863F6492650355F3B97CF3DD308503186
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
2196	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134334856558152513"	msedge.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-668679576-120646659-2289335452-1000\{F4582159-3404-4FD5-A133-87848F256773}	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
712	msedge.exe
712	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
4772	msedge.exe
4772	msedge.exe
4772	msedge.exe
4772	msedge.exe
4772	msedge.exe
4772	msedge.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
4772	msedge.exe
4772	msedge.exe
4772	msedge.exe
4772	msedge.exe
4772	msedge.exe
4772	msedge.exe
4772	msedge.exe
4772	msedge.exe
4772	msedge.exe
4772	msedge.exe
4772	msedge.exe
4772	msedge.exe
4772	msedge.exe
4772	msedge.exe
4772	msedge.exe
4772	msedge.exe
4772	msedge.exe
4772	msedge.exe
4772	msedge.exe
4772	msedge.exe
4772	msedge.exe
4772	msedge.exe
4772	msedge.exe
4772	msedge.exe
4772	msedge.exe
4772	msedge.exe
4772	msedge.exe
4772	msedge.exe
4772	msedge.exe
4772	msedge.exe
4772	msedge.exe
4772	msedge.exe
4772	msedge.exe
4772	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
4772	msedge.exe
4772	msedge.exe
4772	msedge.exe
4772	msedge.exe
4772	msedge.exe
4772	msedge.exe
4772	msedge.exe
4772	msedge.exe
4772	msedge.exe
4772	msedge.exe
4772	msedge.exe
4772	msedge.exe
4772	msedge.exe
4772	msedge.exe
4772	msedge.exe
4772	msedge.exe
4772	msedge.exe
4772	msedge.exe
4772	msedge.exe
4772	msedge.exe
4772	msedge.exe
4772	msedge.exe
4772	msedge.exe
4772	msedge.exe
4772	msedge.exe
4772	msedge.exe
4772	msedge.exe
4772	msedge.exe
4772	msedge.exe
4772	msedge.exe
4772	msedge.exe
4772	msedge.exe

Suspicious use of WriteProcessMemory 33 IoCs

description	pid	Process	procid_target
PID 4772 wrote to memory of 4744	4772	msedge.exe	84
PID 4772 wrote to memory of 2196	4772	msedge.exe	85
PID 4772 wrote to memory of 3928	4772	msedge.exe	86
PID 4772 wrote to memory of 3928	4772	msedge.exe	86
PID 4772 wrote to memory of 3928	4772	msedge.exe	86
PID 4772 wrote to memory of 1156	4772	msedge.exe	87
PID 4772 wrote to memory of 1156	4772	msedge.exe	87
PID 4772 wrote to memory of 2368	4772	msedge.exe	88
PID 4772 wrote to memory of 2368	4772	msedge.exe	88
PID 4772 wrote to memory of 2368	4772	msedge.exe	88
PID 4772 wrote to memory of 2264	4772	msedge.exe	89
PID 4772 wrote to memory of 2264	4772	msedge.exe	89
PID 4772 wrote to memory of 2264	4772	msedge.exe	89
PID 4772 wrote to memory of 1040	4772	msedge.exe	91
PID 4772 wrote to memory of 1040	4772	msedge.exe	91
PID 4772 wrote to memory of 1040	4772	msedge.exe	91
PID 4772 wrote to memory of 4392	4772	msedge.exe	92
PID 4772 wrote to memory of 4392	4772	msedge.exe	92
PID 4772 wrote to memory of 4392	4772	msedge.exe	92
PID 4772 wrote to memory of 3920	4772	msedge.exe	93
PID 4772 wrote to memory of 3920	4772	msedge.exe	93
PID 4772 wrote to memory of 3920	4772	msedge.exe	93
PID 4772 wrote to memory of 2284	4772	msedge.exe	97
PID 4772 wrote to memory of 2284	4772	msedge.exe	97
PID 4772 wrote to memory of 3996	4772	msedge.exe	98
PID 4772 wrote to memory of 3996	4772	msedge.exe	98
PID 4772 wrote to memory of 4320	4772	msedge.exe	100
PID 4772 wrote to memory of 1668	4772	msedge.exe	105
PID 4772 wrote to memory of 1064	4772	msedge.exe	106
PID 4772 wrote to memory of 3956	4772	msedge.exe	107
PID 4772 wrote to memory of 896	4772	msedge.exe	114
PID 4772 wrote to memory of 896	4772	msedge.exe	114
PID 4772 wrote to memory of 712	4772	msedge.exe	116

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument C:\Users\Admin\AppData\Local\Temp\http\old\admin\index.html
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4772
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x260,0x7ff81618c188,0x7ff81618c194,0x7ff81618c1a0
  2⤵
  PID:4744
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1816,i,3455987729681378684,4236861923719046084,524288 --field-trial-handle=2444,i,16361556987997592943,7430109147390288578,262144 --variations-seed-version --mojo-platform-channel-handle=2476 /prefetch:3
  2⤵
  - System Time Discovery
  PID:2196
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1664,i,14610722857015645947,12144519794424288933,262144 --field-trial-handle=2444,i,16361556987997592943,7430109147390288578,262144 --variations-seed-version --mojo-platform-channel-handle=2440 /prefetch:2
  2⤵
  PID:3928
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2240,i,13801316361041734053,10120305417285572330,524288 --field-trial-handle=2444,i,16361556987997592943,7430109147390288578,262144 --variations-seed-version --mojo-platform-channel-handle=3068 /prefetch:8
  2⤵
  PID:1156
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3460,i,10720781621655173752,11310648389998384654,2097152 --field-trial-handle=2444,i,16361556987997592943,7430109147390288578,262144 --variations-seed-version --mojo-platform-channel-handle=3532 /prefetch:1
  2⤵
  PID:2368
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3464,i,4318888158866161342,15116838989325540320,2097152 --field-trial-handle=2444,i,16361556987997592943,7430109147390288578,262144 --variations-seed-version --mojo-platform-channel-handle=3584 /prefetch:1
  2⤵
  PID:2264
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4168,i,13118950463307731053,15225928252929428607,2097152 --field-trial-handle=2444,i,16361556987997592943,7430109147390288578,262144 --variations-seed-version --mojo-platform-channel-handle=4176 /prefetch:1
  2⤵
  PID:1040
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4196,i,5624899833196555832,1474337355031930078,2097152 --field-trial-handle=2444,i,16361556987997592943,7430109147390288578,262144 --variations-seed-version --mojo-platform-channel-handle=4308 /prefetch:2
  2⤵
  PID:4392
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=3636,i,8747770620732297304,2150311899304050096,2097152 --field-trial-handle=2444,i,16361556987997592943,7430109147390288578,262144 --variations-seed-version --mojo-platform-channel-handle=3712 /prefetch:1
  2⤵
  PID:3920
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3784,i,13156501717021951749,8791918631257941351,524288 --field-trial-handle=2444,i,16361556987997592943,7430109147390288578,262144 --variations-seed-version --mojo-platform-channel-handle=5268 /prefetch:8
  2⤵
  PID:2284
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3788,i,6057317387717004112,7723025968053493332,524288 --field-trial-handle=2444,i,16361556987997592943,7430109147390288578,262144 --variations-seed-version --mojo-platform-channel-handle=5292 /prefetch:8
  2⤵
  PID:3996
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5872,i,11840793058634839004,5623724258262261723,524288 --field-trial-handle=2444,i,16361556987997592943,7430109147390288578,262144 --variations-seed-version --mojo-platform-channel-handle=5900 /prefetch:8
  2⤵
  PID:660
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5872,i,11840793058634839004,5623724258262261723,524288 --field-trial-handle=2444,i,16361556987997592943,7430109147390288578,262144 --variations-seed-version --mojo-platform-channel-handle=5900 /prefetch:8
  2⤵
  PID:4320
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4308,i,15824383669856894092,9820886019085406570,524288 --field-trial-handle=2444,i,16361556987997592943,7430109147390288578,262144 --variations-seed-version --mojo-platform-channel-handle=4336 /prefetch:8
  2⤵
  PID:1668
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4184,i,11164301424869947081,14848185936833757923,524288 --field-trial-handle=2444,i,16361556987997592943,7430109147390288578,262144 --variations-seed-version --mojo-platform-channel-handle=4980 /prefetch:8
  2⤵
  PID:1064
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4888,i,5674879403364752797,14975079446327681572,524288 --field-trial-handle=2444,i,16361556987997592943,7430109147390288578,262144 --variations-seed-version --mojo-platform-channel-handle=6280 /prefetch:8
  2⤵
  PID:3956
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5020,i,9111421221525592112,10793335060894101624,524288 --field-trial-handle=2444,i,16361556987997592943,7430109147390288578,262144 --variations-seed-version --mojo-platform-channel-handle=6244 /prefetch:8
  2⤵
  PID:896
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=772,i,15806460519847459874,9892972404116861540,262144 --field-trial-handle=2444,i,16361556987997592943,7430109147390288578,262144 --variations-seed-version --mojo-platform-channel-handle=5724 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:712

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:4748

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

CrashpadMetrics-active.pma

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\CrashpadMetrics-active.pma
Size 16KB
SHA256 814d47aad78c212b52568b9c7b58d242899d490d3afebce66181cae50c880df5
MD5 8c7cdfea4284ba987d295d82a9c7ddd6
SHA1 7d1a3a66f2d64a383b230196ba89a263ce7ee957
SHA512 59c8229e834c944265aed4131c79f41f9f940a48651b9fb18800cef5bae36d17c7fd5880120c6fee8ce22a157b65bc63846b65765bc4dc86e15926dcce400d0d
SSDEEP 12:sf9iXhV0xoUZxCe+JKlkQuMRxCb8TXuYJ0IJpPK6BsyW1inPiz:U9iRqxoUZxWMk8xVTeYWI31BtXP
TLSH
T105724C85B34498FFC8835E7189BD27903774F6DF1F02866B6A6A760E2E271C84F44224
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 81240d13af4ca099e1358c75991e3fa5640dbb3aac72c2d98006f6159bf74aa0
MD5 96dd753cd2d8557b97ab2cd76f7fc6cf
SHA1 81697ccb13fb04a07bd47b552b3607597251f36d
SHA512 355c412a688a71b124e85c0527177b3f97efceb2a5553f8428e0913940daffd3bd176f5476b940c64eee52d543f0568112ac073984d9a64015adc15cbef552de
TLSH
T174D09224BA29A149E282007AA881EB565219DA95296B9622E620C44DBD2B925A3851C2
MD5 SHA1 SHA512 TLSH

Submit Download

9fb656a6-0f57-41da-bac2-5ba400eae121.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\9fb656a6-0f57-41da-bac2-5ba400eae121.tmp
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 94f6493a653dc6c16ba5ac20554d1c3d8592dc5ec840c24ac5dd9d69250f5351
MD5 a55c7207ba0975e2bc7608e55156feaa
SHA1 84958228a505e9e7968df3ebd91d9006d94640ba
SHA512 94277fecb772fa88a17d34dd23f9534fc1ba365220dc5fcc283fd9c2da7e56e18e85cfd2ed114319d5e76953bdc27bd041c039a7f9ddd616116bdfe85dc06a76
TLSH
T137516F38279B03ACD3A4427052E31EB53131B7F9F4936E9112A40635E60BF338A3E2C8
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 949B
SHA256 57c6724384b90c4d8fb35f70469c61cfc5cd9bf7fd13b73a5e9ffa06f8965080
MD5 a5c979b4f6fbeabd23934c1c0482bcf4
SHA1 515dd0cfae2c41644ebfb616e5bb5e809b84ea14
SHA512 ea00a8f91a03d6f835e7dc1360210fd92ac57b87229502386080abe78837c25a0e56d0f72ea9a9d58b28480526cca87db3af978adda5a309ec2ca641ca69e3de
TLSH
T123117AB3C3E585AE894556F05A28EE2BCE2D0A06421C7C19C9D4EF2B93F3475E00295F
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 9KB
SHA256 7fccfd869e7a7b9a03d9709371b2a698cff33ca8dc861deb9a8e5fb48897c276
MD5 87490d2a65a136045224ecd1e6b1d6f8
SHA1 933803e918782ba26b68d38a7fcedad59b4134ff
SHA512 cf5835102712df6c3558423f2255ba8859b45bd146462154d9cdaccc4a861a91ab816ec4dcb0e8f86b46fe6df74831ae3a113516b2a8037a10885ed47109e8ec
SSDEEP 192:sxZcR/Wl/fdsm6xVIdpd0HW6+WNGYCk0raM+UIgrJ:sxZcYl/fdsm6xm2HbG5aMr9
TLSH
T18422B7116E28A57B8CCBE21DBA25BF53E6F95132A1941E58EAFCC61C04E7ADD120740F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 9KB
SHA256 6320472b6ce545ebf15e60292d14804980eaaf86e9c59ce90ef4df657ddb5eac
MD5 c45a573f622131b26a7df48e8a29a387
SHA1 1a6ad519007437d1dfe666807dc053a7134a6121
SHA512 1c5239f7b4310da1905983c813cb865ed3d8dfe5c714d9109c02dd5a55765ac1bf99d3bd2aa0ed9ac815ca73ea222ed09b56502950f305bb72d05b665cbefe47
SSDEEP 192:sxZcR/Wl/fds/6xVIdpd0HW6+WNGYCk0raM+UIg5/J:sxZcYl/fds/6xm2HbG5aMrT
TLSH
T13C22B6116E28A97B8CCBE21DBA15BF53E6F95132A1941E48EAFCC61C04E76DE120740F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 10KB
SHA256 012032ce0f2f7e702916e1f027ea330b930a57f3e7e9db63aef20e209c476920
MD5 a83c7340f6f7975ff115ae44aa44149e
SHA1 928d7a10617fa3758a356aea2a640df43bd33529
SHA512 7a8762b767a8abcf3bfcb0b5c4fa107546e876e982d6c42902a39aaec89a32df3187066813aeab7cfe33f90529a68a6ba997062df5d9479e2c99bb5c5589003b
SSDEEP 192:sxZcR/Wl/fds/2xVIdpH0HW6+WNGYC0FraM+UIg5dJ:sxZcYl/fds/2xmUHbGwaMrF
TLSH
T18422D6126E28A9778CCBE31DBA15BF53E6F9513291941E48EAFCC71C04E7ADE120740B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 10KB
SHA256 41d79aa2a02e7fb1d2c19b1c9490c66626cf693f4f771b8978c995968e87691f
MD5 4a3a8e273f59292df1b4911cab5301de
SHA1 76510c86844141124d84d5a0cf2d1dbdcf58098b
SHA512 03464297ec6bbef9fb740e6f9c863d10dd1ae3164dbf298ae0c99b4a07c3763c6a971caa09ce711d1b4d725d27d8bcefdc5d70cb9319600b51656fb985d4273f
SSDEEP 192:sxZcR/Wl/fds/2xVIdpd0HW6+WNGYC/iraM+UIg5dJ:sxZcYl/fds/2xm2HbGEaMrF
TLSH
T18322D7116E28A97B8CCBE31DBA15BF53E6F9513291941E48EAFCC71C05E7ADE120740B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 27KB
SHA256 245fcfde725013de909ae771ea5a595a8e450792919577225e632e3d2bdf08d2
MD5 3e99800d418b592c236407aa35706f62
SHA1 281faa3a49579effb2b7edf28d26ffc917011414
SHA512 05cb4a863a8fac4e626ba23e47375db973785038580c2053d092a084da5c59f8084727ee0730651fad31a3608d1f63a7155e45907be12fbd757332e491ea4ef0
SSDEEP 768:qKqbUj+WvSCs68F1+UoAYDCx9Tuqh0VfUC9xbog/OVHZLlRTKrxrow:qKqbUj+WvSCs6u1jaaZLbWrKw
TLSH
T1E9C2E93B340CCA7E4F801E9DDD5A6F972E9802C7A7588D4447FA994C02C77EA912B4DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 dfb5ff4de97f2442451885990b1097ec3b530abe6efcb789b0245eec1c21e36c
MD5 a5dc3bc653ea72e81cd182f0f337c531
SHA1 1eff26a41b93bd47f624483444938f2b7a836e60
SHA512 524b85ea03e68d4ae3c55a6c0888c616a47298936571937c90b1e9869bbd658990f53c63989847d68423a1f43d2bd856759d9e619a22d6f8f5c2ec16fc8b1990
SSDEEP 48:KMEIDKVKc/ytvI9KgcwEAIDKFacTyDijAcaMw:KMEAKVKWOvqKgcnAgKFai+
TLSH
T1B891554571BF0211383D6588B356873A4F8139A33054E96F3BBA04665F2BE159EFC8DD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig~RFe597c89.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig~RFe597c89.TMP
Size 3KB
SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
MD5 904e6e94a1d46374c8630cfd86cc729f
SHA1 e1d9c3f7813878acc6510d48d95b2bf48b2e1a0d
SHA512 081e2a26252860ff8d8f7a9d0378ae56f0cc50574d13d2a121afdf74284963747ef874a4d73b1df7774cd8570972f4f513eefe0a0325fd088556d5b1ba946712
TLSH
T1DB815C4FCC0CBE77ABAB6A719A35D6B2F79131EA94518A977F8C444EE3050ED0242E50
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 9dba8a667258a831b23743a2a3978817eff64d662007f0c20b9489742f92acca
MD5 72d7430fd255f8ccbec5a13c66618834
SHA1 40f0ec67774e97da033f4365db230282894c08b6
SHA512 6277a68b2440215cfeb0da97297be2d059471584bc5017f8bdce3361c3a555a2155ef471c7b067d6f241fb2c1e6ed9534466a3bf3a46f1c90d6f011f5bf5c386
SSDEEP 384:gZcIhsNHHUCUA3F6wuEa+SOWOtJrI+1sa+VYcBZkow:ehlFiaHOWOthIAhgTnkb
TLSH
T132828E312D689CB75DB69685F88B36178EF88167D6C96A94C5DCAF0C00DE79C130BC3A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 21KB
SHA256 3f644da449eb073b4d2a1431ea628e5732afa0fd474a3021cc212d880a0ef2b9
MD5 e7f6674690d6644de122148db850e64b
SHA1 eebceb656085e76d988fcfbc18a9963a9a67c5c8
SHA512 b4af4efdba3911e7f37e1c2fba9fbdab0121f7fec90cc6cfaece85be1da2a51625b9034570b9d1d24079a3fea63415db01bdb53ebba9d56d4ab148b5a29bed90
SSDEEP 384:UiFiZcIOsNH88TUNTUlIlnUA3F6wuEa+SOWOtJrh+1sa+VYcBZkow:vFQOpwgOFiaHOWOthhAhgTnkb
TLSH
T12EA25C7319588CBBADB69B85F98B3217CEF44167C5C9AA94D3D89F0D00DB29C134BC26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 81d876431f43126c709a111762572c87cdc78408e9702d23ff1f786c4559dfa9
MD5 9430f331183d0da9ede11cb7358f9223
SHA1 2a46cd37d82099b89162a6a63f09be1494ed7760
SHA512 3005201bb02d8062a500fb27a047ac069c93276da315a65bd8a9d50f14b4dc2a47e5b0ba89b6f05a41e9ce6a27b1a43e2709f28af2c4b44d6a14d3443abd0eca
SSDEEP 384:wZcIhsNHHUnUA3F6wuEa+SOWOtJrI+1sa+VYcBZkow:OhEFiaHOWOthIAhgTnkb
TLSH
T19E828E3129689CB75DB6A685F88B36178EF88167D6C96A94C1DC9F0D00DE79C130BC36
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 e9d86542ccd4d71b9b5e1963779a18ea676d194d4a55b615516e7c7c02314c60
MD5 332b983b997972f444c1ffed07d79dc0
SHA1 458dac9f3cc53901a74a897202bc853514863718
SHA512 02d8fa6b7c5acf9a0c736cdb39c98508d42797888eb8d1a2e9001bf39e7b2819ec4145d2e7f6d9851c43f416c6b2350450600203a8645cda85a9f28781faa41b
SSDEEP 96:EqONkwQsjpf1bxX5ih/cIPURHl8h4otop5FnDRBfPgvE5BzatIRdy+RqOmcPqsQo:vONk6Db6QmiUyZnHBa+jWOm16RgkocU6
TLSH
T10902E83579786CB79EA2AE49F88B37279FE4102BD5962F94DAD81F0C00D764C2347836
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 b1ad3469af422b62a9364719032e2981dd3cd0c0316c1b159994399d7406f77e
MD5 b37904b7fd23e1a8318446bf839af553
SHA1 f2bf6e73e6c9d780d3c842c29e97107aca412af1
SHA512 3eb1d0922566daf28576be1e43a700be26ba8adfafe69cd2343e4bc0981b569fba0736555e6bfd8d1a5b89df6713126c286be25f4ac1075706ab9a82a0501dea
SSDEEP 192:DONzB6DbEQmiUysnLBa+jWOm1OySJrmNzYqw1U6:DONzB6szLBa+SOWOtJrq+1U6
TLSH
T1CC122A3679689C775DA26594F48736279EE84127DA8A7F90D6CC2F0C00EF66C234BC27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f6943445-22cf-4e4a-8ffa-56d0ad1df5e8.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\f6943445-22cf-4e4a-8ffa-56d0ad1df5e8.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 5c3355f119218b54c8a41dcf5f212a02cbcde65d55d5869d3a913a3c79014aa6
MD5 e7c5dc9de68ee723bd31f8f1b5ed4a58
SHA1 313baa2f748e434f1d8781d7cb0d8abf789414d6
SHA512 66dc58f7820236877a4e880a1e562ffb906404fbc1e117e37b55bd84993ac1db3f36ad624ea90e278eb82030b27f709ed925bfce3a308402df7b98a107d1fb81
TLSH
T15B411C59AAEA1148B3B76F169FF6B86E487B7D672E06D55E10010D4F0633B40C871B37
MD5 SHA1 SHA512 TLSH

Submit Download