294518cc925310660f00a3f3d392effa3a8e8941de4750e748e1175f693c8b1b

Analysis

max time kernel
148s
max time network
142s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
16/09/2026, 16:07

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
pb/htm/mc001203.htm
Size 17B
Sample260916-tkzgpsdk5v
SHA256 294518cc925310660f00a3f3d392effa3a8e8941de4750e748e1175f693c8b1b
MD5 74df4244adcd334c1c7a77d0142d4f2d
SHA1 480ea07442a226d60e2e6c643224e3021b48599e
SHA512 f330d36a973c61a38011259ae5932b45f7fd7a6943d55c623105bb584066594780e8c408a22aa8c79bd0f47cc105c229cae26d6f7e427452de1646631ba3503d
MD5 SHA1 SHA512

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
2404	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134340484670003669"	msedge.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-240542094-4193773837-3211495583-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-240542094-4193773837-3211495583-1000\{068DD0FB-37BC-42D1-AF54-8D9E5D14281C}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3640	msedge.exe
3640	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
1432	msedge.exe
1432	msedge.exe
1432	msedge.exe
1432	msedge.exe
1432	msedge.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
1432	msedge.exe
1432	msedge.exe
1432	msedge.exe
1432	msedge.exe
1432	msedge.exe
1432	msedge.exe
1432	msedge.exe
1432	msedge.exe
1432	msedge.exe
1432	msedge.exe
1432	msedge.exe
1432	msedge.exe
1432	msedge.exe
1432	msedge.exe
1432	msedge.exe
1432	msedge.exe
1432	msedge.exe
1432	msedge.exe
1432	msedge.exe
1432	msedge.exe
1432	msedge.exe
1432	msedge.exe
1432	msedge.exe
1432	msedge.exe
1432	msedge.exe
1432	msedge.exe
1432	msedge.exe
1432	msedge.exe
1432	msedge.exe
1432	msedge.exe
1432	msedge.exe
1432	msedge.exe
1432	msedge.exe
1432	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
1432	msedge.exe
1432	msedge.exe
1432	msedge.exe
1432	msedge.exe
1432	msedge.exe
1432	msedge.exe
1432	msedge.exe
1432	msedge.exe
1432	msedge.exe
1432	msedge.exe
1432	msedge.exe
1432	msedge.exe
1432	msedge.exe
1432	msedge.exe
1432	msedge.exe
1432	msedge.exe
1432	msedge.exe
1432	msedge.exe
1432	msedge.exe
1432	msedge.exe
1432	msedge.exe
1432	msedge.exe
1432	msedge.exe
1432	msedge.exe
1432	msedge.exe
1432	msedge.exe
1432	msedge.exe
1432	msedge.exe
1432	msedge.exe
1432	msedge.exe
1432	msedge.exe
1432	msedge.exe

Suspicious use of WriteProcessMemory 30 IoCs

description	pid	Process	procid_target
PID 1432 wrote to memory of 3032	1432	msedge.exe	84
PID 1432 wrote to memory of 2404	1432	msedge.exe	85
PID 1432 wrote to memory of 3980	1432	msedge.exe	86
PID 1432 wrote to memory of 3980	1432	msedge.exe	86
PID 1432 wrote to memory of 3980	1432	msedge.exe	86
PID 1432 wrote to memory of 4244	1432	msedge.exe	87
PID 1432 wrote to memory of 4244	1432	msedge.exe	87
PID 1432 wrote to memory of 5052	1432	msedge.exe	89
PID 1432 wrote to memory of 2632	1432	msedge.exe	90
PID 1432 wrote to memory of 5052	1432	msedge.exe	89
PID 1432 wrote to memory of 5052	1432	msedge.exe	89
PID 1432 wrote to memory of 2632	1432	msedge.exe	90
PID 1432 wrote to memory of 2632	1432	msedge.exe	90
PID 1432 wrote to memory of 4512	1432	msedge.exe	91
PID 1432 wrote to memory of 4512	1432	msedge.exe	91
PID 1432 wrote to memory of 4512	1432	msedge.exe	91
PID 1432 wrote to memory of 1908	1432	msedge.exe	92
PID 1432 wrote to memory of 1908	1432	msedge.exe	92
PID 1432 wrote to memory of 1908	1432	msedge.exe	92
PID 1432 wrote to memory of 3856	1432	msedge.exe	97
PID 1432 wrote to memory of 3856	1432	msedge.exe	97
PID 1432 wrote to memory of 1320	1432	msedge.exe	96
PID 1432 wrote to memory of 1320	1432	msedge.exe	96
PID 1432 wrote to memory of 5108	1432	msedge.exe	101
PID 1432 wrote to memory of 1500	1432	msedge.exe	109
PID 1432 wrote to memory of 4716	1432	msedge.exe	110
PID 1432 wrote to memory of 4376	1432	msedge.exe	111
PID 1432 wrote to memory of 2628	1432	msedge.exe	113
PID 1432 wrote to memory of 2628	1432	msedge.exe	113
PID 1432 wrote to memory of 3640	1432	msedge.exe	116

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument C:\Users\Admin\AppData\Local\Temp\pb\htm\mc001203.htm
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1432
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x25c,0x7ffd3c4dc188,0x7ffd3c4dc194,0x7ffd3c4dc1a0
  2⤵
  PID:3032
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1824,i,11689468474684759200,5661565233533718588,524288 --field-trial-handle=2288,i,861712021775408280,14987399172554429673,262144 --variations-seed-version --mojo-platform-channel-handle=2392 /prefetch:3
  2⤵
  - System Time Discovery
  PID:2404
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1680,i,12351401978831256244,12301833179107598325,262144 --field-trial-handle=2288,i,861712021775408280,14987399172554429673,262144 --variations-seed-version --mojo-platform-channel-handle=2284 /prefetch:2
  2⤵
  PID:3980
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2596,i,6339772641483735521,3132865191624029395,524288 --field-trial-handle=2288,i,861712021775408280,14987399172554429673,262144 --variations-seed-version --mojo-platform-channel-handle=2660 /prefetch:8
  2⤵
  PID:4244
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3448,i,16820632468521215309,3473159471261657812,2097152 --field-trial-handle=2288,i,861712021775408280,14987399172554429673,262144 --variations-seed-version --mojo-platform-channel-handle=3520 /prefetch:1
  2⤵
  PID:5052
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3452,i,11428760286217733742,12037578970391623580,2097152 --field-trial-handle=2288,i,861712021775408280,14987399172554429673,262144 --variations-seed-version --mojo-platform-channel-handle=3524 /prefetch:1
  2⤵
  PID:2632
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4224,i,13888877051179756878,4646575583927425253,2097152 --field-trial-handle=2288,i,861712021775408280,14987399172554429673,262144 --variations-seed-version --mojo-platform-channel-handle=4220 /prefetch:1
  2⤵
  PID:4512
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4284,i,5746424854787766895,5958925446314315078,2097152 --field-trial-handle=2288,i,861712021775408280,14987399172554429673,262144 --variations-seed-version --mojo-platform-channel-handle=4248 /prefetch:2
  2⤵
  PID:1908
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5116,i,14416906760831876657,13064516076164768067,524288 --field-trial-handle=2288,i,861712021775408280,14987399172554429673,262144 --variations-seed-version --mojo-platform-channel-handle=5156 /prefetch:8
  2⤵
  PID:1320
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3624,i,4957737103235014689,15202246496780207087,524288 --field-trial-handle=2288,i,861712021775408280,14987399172554429673,262144 --variations-seed-version --mojo-platform-channel-handle=5180 /prefetch:8
  2⤵
  PID:3856
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5796,i,14590026072451223543,7554540883915400861,524288 --field-trial-handle=2288,i,861712021775408280,14987399172554429673,262144 --variations-seed-version --mojo-platform-channel-handle=5856 /prefetch:8
  2⤵
  PID:1532
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5796,i,14590026072451223543,7554540883915400861,524288 --field-trial-handle=2288,i,861712021775408280,14987399172554429673,262144 --variations-seed-version --mojo-platform-channel-handle=5856 /prefetch:8
  2⤵
  PID:5108
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4536,i,16194146724257958201,4283340665321907050,524288 --field-trial-handle=2288,i,861712021775408280,14987399172554429673,262144 --variations-seed-version --mojo-platform-channel-handle=4320 /prefetch:8
  2⤵
  PID:1500
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4520,i,11309596055078116241,17656762713296380292,524288 --field-trial-handle=2288,i,861712021775408280,14987399172554429673,262144 --variations-seed-version --mojo-platform-channel-handle=3620 /prefetch:8
  2⤵
  PID:4716
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4524,i,4414479658164580997,18161706572648454440,524288 --field-trial-handle=2288,i,861712021775408280,14987399172554429673,262144 --variations-seed-version --mojo-platform-channel-handle=4528 /prefetch:8
  2⤵
  PID:4376
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6300,i,14333190732640957375,10072162636654578376,524288 --field-trial-handle=2288,i,861712021775408280,14987399172554429673,262144 --variations-seed-version --mojo-platform-channel-handle=4504 /prefetch:8
  2⤵
  PID:2628
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=780,i,15994679784559394073,13716835193709852783,262144 --field-trial-handle=2288,i,861712021775408280,14987399172554429673,262144 --variations-seed-version --mojo-platform-channel-handle=6120 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3640

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:964

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:2476

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

blocklist

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\blocklist
Size 105KB
SHA256 6fa1b02b96b249c932f11a4c4f1eb52f042c98bf33d02c325fd422f437c15214
MD5 dab629217416704f76a79a88ad8104e7
SHA1 7976f0ba766ba9c277031e8bb5fb53af02fda376
SHA512 08718b5a2794b585eb95d2cba2f1738b354033d24a471097fdf4f83b9cfe6ba984c2b3c4dae177b4e601dc47eb8b72225f8677ed39d32449fb3f874f22b26d8d
SSDEEP 1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P7+:fwUQC5VwBIiElEd2K57P7+
TLSH
T1C1B3B931457E36BF26E93EE828CF1511B84F3912664895D4ABE1FE2C4845E68633CEF4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 98f220c14bd3d385f1dd482d8b868745c75685e4a2573b4336f235cf3bdce6c1
MD5 6ce50f5d79ab86d6489a63e08ead9ec4
SHA1 d52fb22446c08230d0edc8374b1dcaed1af585ea
SHA512 fd66aaada3f82de40a9236f167ecb23bc285a49f72374f567e078118a8bdb229e4fadc26c639553cfacaa7d7ba44e0419f17b4bb4a9a8999b51bdd037a28783a
TLSH
T189D02BF4E69455E4D441283C11130304314CC4001C033010C46141D21D8D7C2009A068
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 2KB
SHA256 cfb7e3698da4a8786baaf9d30946bd041fbcc33ee4b9ef4f6841a70be7327bc6
MD5 f4b6dd27f05cfc5ff3938b445477e558
SHA1 a9635146668d55fd5b9c1f9c52606fe047839211
SHA512 d449d21408e53a4c59b69f4792779545885ebd28c49a0abc30c5cdc2a46aed6ca1170fb27903b12f4c166030ec48d60c8b0f33eb027efc525715d5983d8b8728
TLSH
T1EE41F883E7F5B095DFAB473188D104B7363898B2ED43ED12C4B8C0B97B4EB0692042A3
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 949B
SHA256 a9891d4e989b33a119915073a1020775720ea2b7de2574e84e12e8452396b03b
MD5 609b753f28a0e8394a8bbb9eb49faceb
SHA1 1d807d35fd4da89d76aa3e7f141fd74f966d65dd
SHA512 4900b546631ae5592d7bca990b4c8a1ecaaf73137633b175295579b613f3d8a4d98525feae75fca24a6e806d072dbbd130f673467d1b794662e5dde120c0ba80
TLSH
T114117DB3C3D585AE8D1156F06A28AE2BCE2D0606421C7C1989D4EF2BD3F3479E40255F
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 9KB
SHA256 1d8b70155d560ccd0f8b9b5a1c42ae16c3f7fcda7cf9eb65a1d9a8cf973105a4
MD5 8d81d41636368a75d971db185fd9c03e
SHA1 a513591ebeefc023e60ac10ffdf618c754a4b008
SHA512 184364ebd8fbd73771c0a808eaf635fa1cd0dd0e1a735c37bd52da9109bacb52e0e30a7dd592d5df56847549458338377034a2e33c584ccb52e0c9e04fece0c1
SSDEEP 192:sxZsWRDWr/fNsFU8IdpdGHW6+WNGYrbu4iEIgrJ:sxZsWUr/fNsmlIHbGM9
TLSH
T1C012B7167E28A53B8CC7D20DBA19BF13D6F9503251D51E58FAFC861C05E6ACD120780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 10KB
SHA256 084b33f674450ea850a5cffd04012caadd9b3d41c04164e6034141b9d06b5f4a
MD5 b62d266ac74c740f43f875f7b64e82c9
SHA1 017374d4641358ccb8a92f8357391673015c3524
SHA512 ea625341224b7a9da3c7288be9df07b706ee89bb6064c4a175f993a89c943ba858f3e9be0432d73b3b572f7b3c53da404fdbe69faa86134f771341d268056803
SSDEEP 192:sxZsWRDWr/fNskU8IdpHGHW6+WNGYrLu4iEIg5uJ:sxZsWUr/fNsDlmHbGkc
TLSH
T16C22C7567E28A93B8CC7E20DBA59BF53E6F9543251911E44AAFC871C05E7ACD220780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 9KB
SHA256 acd244adbbff4793997decde3c8eb9c17c9e14b5bef239740967129f382ddfee
MD5 67f4886dc5b9b5c9444f3d5101c47420
SHA1 5a7591a1450126312c8cee818711ad0df5fa17cf
SHA512 35701dcc6813cd8cb6f31553a839b7cc25722a49c8dfba6fa08b3cbdd7bda06f5434c1e11506d2ebd149fa6421408c5e4faf4292e4dfb6772493a33985abb60e
SSDEEP 192:sxZsWRDWr/fNsQU8IdpdGHW6+WNGYrbu4iEIg58J:sxZsWUr/fNs3lIHbGMu
TLSH
T16922B7167E28A93B8CC7D20DBB59BF53D6F9503251D51E88AAFC861C05E7ACD220780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 10KB
SHA256 c6960f92e8c35604afe62c26cdd25fabde9d1b50b602aa15e515ec5c10ff52c8
MD5 87d10eb0e0e008927dc84e564edd13c1
SHA1 e2a1019d724364fdf531b96f50b617423f155aed
SHA512 ab18e5bf27d3ddfa4f61b587a8c35fc7f2393da2fd7fbf04841beffda5e3b310068a115de5b0e31550f1354dd3cbcdd70527e3c559df7023de741ddb7a092e26
SSDEEP 192:sxZsWRDWr/fNskU8IdpdGHW6+WNGYrRu4iEIg5uJ:sxZsWUr/fNsDlIHbGCc
TLSH
T11F22B6567E28A93B8CC7E20DBB59BF53E6F9503251951E44AAFC871C05E7ACD220780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 27KB
SHA256 bcccf044fc777828c70aa916b6c25b330b84d00cee15a8ac253e9c0904d68e31
MD5 ae0d864689afc31d1ebb210818446a30
SHA1 62d58e93532ef4b52452ad30b7840334c33d4b01
SHA512 a9d04f71ba32a7886d75072f97a740d8c08f3714f2bb091ec2eb2e09186ee1ecd71825a181164162246435caa6ce3dd97c82c91ada0008d03f81028ba2ae31be
SSDEEP 768:4xy4J/DWvbtBh8F1+UoAYDCx9Tuqh0VfUC9xbog/OVCiLlc2Tb7roRNWc:4xy4J/DWvbtBhu1jajiLm0bITWc
TLSH
T15EC2FA3B684CCA7E4FC00A9DED5E6FD73E9802C796948D4047FA994C02C77EA51264DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 7KB
SHA256 5432c8edb8fd9309d52b6db23b2b352abdf4c1fd8af801b3e2782f31a634138e
MD5 5053e54e10542f7d4e8914ba2aef2e59
SHA1 07a33d9625c3311fad7498be185e3c9d95428a22
SHA512 f54b3b616916acc46c149746c036dc6e972fe0ba249070e41de1a70d186f33a6e2455cc047eb866e2c7f7fa404d1d4c4ae008f736e5d1c225cc8cb93abc1c1c6
SSDEEP 96:KIDCKs0+aCYKjilmBA9xvDnk3DePdJkKlBdHk5Rx+vzR6KaM6qEQKxyqe:E53smBA9xvDn6DelJFBdHKRx+v21vk
TLSH
T104E1D05135BB020038BD769881B5872E52423677301AEA3BBFFC40A68E6BE445DFE5CD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig~RFe5a3838.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig~RFe5a3838.TMP
Size 3KB
SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
MD5 904e6e94a1d46374c8630cfd86cc729f
SHA1 e1d9c3f7813878acc6510d48d95b2bf48b2e1a0d
SHA512 081e2a26252860ff8d8f7a9d0378ae56f0cc50574d13d2a121afdf74284963747ef874a4d73b1df7774cd8570972f4f513eefe0a0325fd088556d5b1ba946712
TLSH
T1DB815C4FCC0CBE77ABAB6A719A35D6B2F79131EA94518A977F8C444EE3050ED0242E50
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 12KB
SHA256 91609ca350833e1995e117028d369523a7da74441101c06845893dd750ba7c3b
MD5 9ac0969772c0c086983ac230f25ea1e2
SHA1 8e7a7006fb7400f401627bd659c80082b6eebc7e
SHA512 e2f1b426621893dff74d237f7fd7bbc327ee295318decb96488041d882a6d1331b82bb00e40bab172bac67510061731f96e66c32782272db50fd01ebc8eee2a1
SSDEEP 192:uunsNfGQRprlDZKoQmiU1aJ/y4HX58gZrvOKGPaNtUPt/NLqyc:jsNfG8Z5K/9HX58EzO/AQrXc
TLSH
T183422A36B878AD371EE69545F54636039FB49167D6892F90C6EC5B0E02DA29C230BC17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 41b23909c4c16248fd9e507e4fca875f9a6dc238763a9f9e67193196d2005ae8
MD5 1f624d491f0cce0f3d4a047991ec64d5
SHA1 619fa2ac61b3cd5ecd15d33ad1b4b912fa5279a7
SHA512 46098f36dac05e0b3b7982f79dc484fea378efe4b25a4186b708c036009e8f1e1a3344ab1934cae0755527807230db7f010bb53b0724a1191a646ea622749fa6
SSDEEP 384:nZcIpsNfd8Z5K/9HX58EzO/AQrsa+VYTl/oi:PpRW/JakO/LrhgKl
TLSH
T1F2826C366978AD375DE7D285F98636038FB49077D2C96F9086ECAB0E01DA69C1307C17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 f63a659f91b64ac384615df5285122684d4537980d40e926918d491b4bb0d042
MD5 d9eadd5334db5c1c024f1d9184e1339b
SHA1 0b931b6a354413c14b4a6dbfedad11c9333f4079
SHA512 5b34b22ada3ca21a8ab2e0043a3c00462b43a3640dd119200ceef889a62e403752bc102f89359e836dd02cccb0fed50e6560ce10bd449056f5aee88e8670e28b
SSDEEP 192:1ON36wlDgQmiUyDVW4X58gZrvOKG/DlFvU6:1ON36kgeW4X58EzO59U6
TLSH
T13602EA38B9687C7B8EF3AD09F58B36139FA5203BE6556F84C6E81A1D01D729C1307923
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 e9af80f4346fb189393f8e7d489f3109853904600f3b3c75d9333b8e14f4c646
MD5 e406fba038438f8d036a35d4339aaacc
SHA1 dadd750fd297f8bc5aaf488505b5db37397f499f
SHA512 5cf20357a5ca9171ddb55a1550fddb476d69b782fcc45b4d86ae8e2a3bd89fd053bc1f10081eb2bb3ba72acbac3917c695a9f404f690cfec81998ba8b31bda5f
SSDEEP 192:1ONC6wlD+QmiUyvVn4X58gZrvOKGPaNyvet/NU6:1ONC6k6Un4X58EzO/AVrU6
TLSH
T1F312F935B9A8BC275EE2A544F48735039FA55127EB467F90C6EC2B1D01EF2AC130B917
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 12KB
SHA256 a65f53d34b92055bb9bd0dd73aa350df102bc00a89fe9b0c5fde3ff3071e9f2c
MD5 69a96b93b12171da48893078ed8bc99f
SHA1 1951093bf90c7e0c61b61c3bff354495982eac00
SHA512 cfd5fa3e54c087d65f2dfc20f2ed4ed59800cd67b3153c5669109dbf2f402aa27d00302b0fac2a7c2ed5211cfdecf5bec3a0ac4aecf7288d2567f838c68af122
SSDEEP 192:uunsNfGQRprlDZK1QmiU1aJ/y4HX58gZrvOKGPaNtUPt/NLqyc:jsNfG8ZUK/9HX58EzO/AQrXc
TLSH
T1AA422A36B878AD371EE29545F54636039FB45167D6893F90C6EC5B0E02DA29C230BC17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 21KB
SHA256 0771278ee4ee6c72867573bb0ee3d32f470d5637028a45984e97f4ae2a5f1571
MD5 9643d47a5b39088926118ac4f8607481
SHA1 0b9207bbced1dc389ce2841cc2f77cd80d90cca6
SHA512 71a54f4aa6e066109f11b4b35bfb067c9d3bbf9707fd557c265824050434f7223803b5f3de6b4ccb5dc7f06b0646229262e2e2f9bc735956395821195004019b
SSDEEP 384:H1iFiZcIXPsNB8TUNTUlIld8Z5K/9HX58EzO/Agrsa+VYTl/oi:H8FQ/QwgAW/JakO/HrhgKl
TLSH
T131A25C3769A8DD3B9DF69A81F98636038FB45077C6C5AA90D7DC9B0D01DA2DC1307C16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

3e38303b-997f-4f7d-9aed-4f911d55f8b7.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\3e38303b-997f-4f7d-9aed-4f911d55f8b7.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 d0c578a00f2bc94cc99302cc175c9f856fc629ba20ee42045e67671e8eae711c
MD5 5488aa9c9ae92d4e8c767045e8dd4273
SHA1 23e176da07e74017474d9c73d709b76de148e087
SHA512 136fe0a5220f9e7b8f3448933edaeef538ef1a3ab6bd72f9330e264c935eda8f868fd2d9a2d04340498937c66d8d7f791df7609ff260d415af45c03e641dae1c
TLSH
T1D0413A68B6F91108B3B77E5A9BF2A86E487EBD372F06D45D40110E4E0A26A44CCB1737
MD5 SHA1 SHA512 TLSH

Submit Download