fbedca8cca15a55af192bb110563b3b0998e8d25b2a41c0e156ac2c2536f2d1a

Analysis

max time kernel
148s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
16/09/2026, 18:34

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
google28a58557609fd155.html
Size 53B
Sample260916-w79bjayw2k
SHA256 fbedca8cca15a55af192bb110563b3b0998e8d25b2a41c0e156ac2c2536f2d1a
MD5 5b3e88685af6d39163ae3488ef096976
SHA1 4fdd9803ba4922e264ac747b1259899dbad66baf
SHA512 555311972dddff159276d43c570979edc1ed35047dce2d5bf010b77b677a115be5381f6bff4ecfdb7c00096172e149420b71065da3abecea82b55e4bfa07c5db
TLSH
T14C900243FC4A150696838626A1C456505321550ABD77110259D2A30966002879241481
MD5 SHA1 SHA512 TLSH

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
1980	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134340573048691227"	msedge.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2101206053-1414382737-268919432-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2101206053-1414382737-268919432-1000\{554DB7B8-BFF3-41C1-B834-66E97698778A}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1004	msedge.exe
1004	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
2748	msedge.exe
2748	msedge.exe
2748	msedge.exe
2748	msedge.exe
2748	msedge.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
2748	msedge.exe
2748	msedge.exe
2748	msedge.exe
2748	msedge.exe
2748	msedge.exe
2748	msedge.exe
2748	msedge.exe
2748	msedge.exe
2748	msedge.exe
2748	msedge.exe
2748	msedge.exe
2748	msedge.exe
2748	msedge.exe
2748	msedge.exe
2748	msedge.exe
2748	msedge.exe
2748	msedge.exe
2748	msedge.exe
2748	msedge.exe
2748	msedge.exe
2748	msedge.exe
2748	msedge.exe
2748	msedge.exe
2748	msedge.exe
2748	msedge.exe
2748	msedge.exe
2748	msedge.exe
2748	msedge.exe
2748	msedge.exe
2748	msedge.exe
2748	msedge.exe
2748	msedge.exe
2748	msedge.exe
2748	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
2748	msedge.exe
2748	msedge.exe
2748	msedge.exe
2748	msedge.exe
2748	msedge.exe
2748	msedge.exe
2748	msedge.exe
2748	msedge.exe
2748	msedge.exe
2748	msedge.exe
2748	msedge.exe
2748	msedge.exe
2748	msedge.exe
2748	msedge.exe
2748	msedge.exe
2748	msedge.exe
2748	msedge.exe
2748	msedge.exe
2748	msedge.exe
2748	msedge.exe
2748	msedge.exe
2748	msedge.exe
2748	msedge.exe
2748	msedge.exe
2748	msedge.exe
2748	msedge.exe
2748	msedge.exe
2748	msedge.exe
2748	msedge.exe
2748	msedge.exe
2748	msedge.exe
2748	msedge.exe

Suspicious use of WriteProcessMemory 30 IoCs

description	pid	Process	procid_target
PID 2748 wrote to memory of 3284	2748	msedge.exe	85
PID 2748 wrote to memory of 1980	2748	msedge.exe	86
PID 2748 wrote to memory of 2812	2748	msedge.exe	87
PID 2748 wrote to memory of 2812	2748	msedge.exe	87
PID 2748 wrote to memory of 2812	2748	msedge.exe	87
PID 2748 wrote to memory of 3504	2748	msedge.exe	88
PID 2748 wrote to memory of 3504	2748	msedge.exe	88
PID 2748 wrote to memory of 2212	2748	msedge.exe	89
PID 2748 wrote to memory of 2212	2748	msedge.exe	89
PID 2748 wrote to memory of 2224	2748	msedge.exe	90
PID 2748 wrote to memory of 2212	2748	msedge.exe	89
PID 2748 wrote to memory of 2224	2748	msedge.exe	90
PID 2748 wrote to memory of 2224	2748	msedge.exe	90
PID 2748 wrote to memory of 4520	2748	msedge.exe	92
PID 2748 wrote to memory of 4948	2748	msedge.exe	93
PID 2748 wrote to memory of 4520	2748	msedge.exe	92
PID 2748 wrote to memory of 4520	2748	msedge.exe	92
PID 2748 wrote to memory of 4948	2748	msedge.exe	93
PID 2748 wrote to memory of 4948	2748	msedge.exe	93
PID 2748 wrote to memory of 2112	2748	msedge.exe	97
PID 2748 wrote to memory of 4908	2748	msedge.exe	98
PID 2748 wrote to memory of 2112	2748	msedge.exe	97
PID 2748 wrote to memory of 4908	2748	msedge.exe	98
PID 2748 wrote to memory of 2516	2748	msedge.exe	100
PID 2748 wrote to memory of 1996	2748	msedge.exe	105
PID 2748 wrote to memory of 2400	2748	msedge.exe	106
PID 2748 wrote to memory of 3860	2748	msedge.exe	107
PID 2748 wrote to memory of 4308	2748	msedge.exe	109
PID 2748 wrote to memory of 4308	2748	msedge.exe	109
PID 2748 wrote to memory of 1004	2748	msedge.exe	112

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument C:\Users\Admin\AppData\Local\Temp\google28a58557609fd155.html
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2748
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x260,0x7ffaf15bc188,0x7ffaf15bc194,0x7ffaf15bc1a0
  2⤵
  PID:3284
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1952,i,16768513040685369148,4341744711306071172,524288 --field-trial-handle=2276,i,14796510683460977206,12845458140417168420,262144 --variations-seed-version --mojo-platform-channel-handle=2340 /prefetch:3
  2⤵
  - System Time Discovery
  PID:1980
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1864,i,15704342654953162872,16969921591415002115,262144 --field-trial-handle=2276,i,14796510683460977206,12845458140417168420,262144 --variations-seed-version --mojo-platform-channel-handle=2260 /prefetch:2
  2⤵
  PID:2812
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2396,i,5015493819395031041,6809843115087032889,524288 --field-trial-handle=2276,i,14796510683460977206,12845458140417168420,262144 --variations-seed-version --mojo-platform-channel-handle=2384 /prefetch:8
  2⤵
  PID:3504
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3420,i,10932134214564682575,13641572567731011545,2097152 --field-trial-handle=2276,i,14796510683460977206,12845458140417168420,262144 --variations-seed-version --mojo-platform-channel-handle=3472 /prefetch:1
  2⤵
  PID:2212
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3424,i,2752084721203998757,7371355206588803451,2097152 --field-trial-handle=2276,i,14796510683460977206,12845458140417168420,262144 --variations-seed-version --mojo-platform-channel-handle=3480 /prefetch:1
  2⤵
  PID:2224
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4244,i,15495867949737737356,13090807169294255403,2097152 --field-trial-handle=2276,i,14796510683460977206,12845458140417168420,262144 --variations-seed-version --mojo-platform-channel-handle=4272 /prefetch:2
  2⤵
  PID:4520
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4228,i,5657775153639870774,12499510225637338454,2097152 --field-trial-handle=2276,i,14796510683460977206,12845458140417168420,262144 --variations-seed-version --mojo-platform-channel-handle=4252 /prefetch:1
  2⤵
  PID:4948
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5216,i,8193408172138357448,11925864296514163544,524288 --field-trial-handle=2276,i,14796510683460977206,12845458140417168420,262144 --variations-seed-version --mojo-platform-channel-handle=5236 /prefetch:8
  2⤵
  PID:2112
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5220,i,9935013187157670033,2501526513821077401,524288 --field-trial-handle=2276,i,14796510683460977206,12845458140417168420,262144 --variations-seed-version --mojo-platform-channel-handle=5256 /prefetch:8
  2⤵
  PID:4908
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5908,i,5162630830263190711,17090767212797737039,524288 --field-trial-handle=2276,i,14796510683460977206,12845458140417168420,262144 --variations-seed-version --mojo-platform-channel-handle=5904 /prefetch:8
  2⤵
  PID:840
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5908,i,5162630830263190711,17090767212797737039,524288 --field-trial-handle=2276,i,14796510683460977206,12845458140417168420,262144 --variations-seed-version --mojo-platform-channel-handle=5904 /prefetch:8
  2⤵
  PID:2516
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4420,i,8673899943733028258,1189417116100849592,524288 --field-trial-handle=2276,i,14796510683460977206,12845458140417168420,262144 --variations-seed-version --mojo-platform-channel-handle=4312 /prefetch:8
  2⤵
  PID:1996
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4424,i,9023352236127133961,1324481278809054470,524288 --field-trial-handle=2276,i,14796510683460977206,12845458140417168420,262144 --variations-seed-version --mojo-platform-channel-handle=4488 /prefetch:8
  2⤵
  PID:2400
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4500,i,16800494546926413018,11745408125136706848,524288 --field-trial-handle=2276,i,14796510683460977206,12845458140417168420,262144 --variations-seed-version --mojo-platform-channel-handle=4272 /prefetch:8
  2⤵
  PID:3860
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1000,i,17193115497879173434,6881256719610540555,524288 --field-trial-handle=2276,i,14796510683460977206,12845458140417168420,262144 --variations-seed-version --mojo-platform-channel-handle=4244 /prefetch:8
  2⤵
  PID:4308
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6436,i,8517433757550625166,5174051144169433625,262144 --field-trial-handle=2276,i,14796510683460977206,12845458140417168420,262144 --variations-seed-version --mojo-platform-channel-handle=5868 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1004

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:2480

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:4656

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 61a97be736e0441d45644d31b38bd9bef6c1bd260fa1ecbb5d099fa493fee6b4
MD5 99bbd8400adc948f85ebd87cb24b3fcb
SHA1 c8fb9564ede7ecb06cef446bdb527025127a796e
SHA512 75b3ee70eca487cbbfb3d5b4b25bae158ff99188ab36d55f391e9f80c51ce9fa433897d79a0ae37ad64698bc3eb5aa9a10a49116fb8f7f35ed0a6e98aa8321b7
TLSH
T109D022C8F2A0300CE00C3233A02BCE022B88CEA8F0032BCA000E8C80E8800C80CF2C8E
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 87a6b56b3a47cfd9f58f49b21d0040033c8cfd80b50e49b434794cefa7e29583
MD5 74ef2da89fa243ea7d0030317efca192
SHA1 ceb38f6fe8b62f80d617114db8b4617467417ae3
SHA512 285847f78095225db6f446ab877593c3e8e9c642b3beec1b15e7b1eec59d6b2f61ada0e2fb96cf36a3046dbd5102c274473cea5f978ee83b010039a4dc00d05d
TLSH
T10DD024C471D0340CD40C31335015CD011744CD54F00317C7000D4C40C4400C40CF1C4D
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 419d12d70bd9e8f095bd09e99c1bfafc4c0756efae86cb0cbb58c9e8f1962d46
MD5 fa0bb70582b33db1d95a90e73f4ed3c4
SHA1 3ffd8797cde9669a8124903b9c30f3edff2b66e8
SHA512 535c26259ad3c616b756ba189634575946548ba0c034aebee5f2c202f5e4299893477b8f73e251281a56cf79ea6814db8f026f50a3e9ecd5d593aa8c14bc02d2
TLSH
T1206184A35E40A0DDFBAAE573B7C925873930C590A1431DE11A58D4F758C67FB628A870
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe591dfe.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe591dfe.TMP
Size 3KB
SHA256 59f666e726acf9ce2b5673fe5d1feb47dade5562f1726fcdbfee6fe53bb16a62
MD5 697465200dba03efd9c5f1183ef70abf
SHA1 e7b5105abe58f7053d853c9d631d4cdcae99b94f
SHA512 3ed948aaae687f6cdf7a3cf1e856b88336fe731ce3e4d26e15bdb68ac07cc93534d4cd04c3e954cb79a350110d13596c9bc48b89d59e66c4d5de1ecfaca065d1
TLSH
T10961A5A34F40A0DDFBAAE573B7C925873E30C590A1431DE10A58D4F758C67FB228A870
MD5 SHA1 SHA512 TLSH

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 949B
SHA256 d4ceadb12d2e4b42a47f0ab0eefce54892f6e467494b111b06dc224cd50412bb
MD5 b7ebfd9ba249d5ae4fafada640be946a
SHA1 5d66c65769e6c517081d701110d2857527d1c079
SHA512 615c54411959ebe66d3e9551e4ed1ecca01949118336b0821f487c90bb9d7d73755317c27e1e42bd2359f9d0864d36977dfc7e3782305d9dd838eacabaa712ce
TLSH
T103117DF7C3D5956E89015AF05A28AE2BCE2D0505422C7C1AC9D4EF27D3E3075E00155B
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 9KB
SHA256 a09d9b5816064274b1a00ac50769d887eea873d3ab233df1cac3fa385f3731c3
MD5 a0abf5ba3d5809136f746a10725f9f6d
SHA1 db599b6660d69cdf99e8c54889dcef3f4c63baa5
SHA512 68c253298e93d9062884897efdf0fcdaad32d8553a8bd43cc9ce657bd72b5499fdcab66f5f274dd294632ac0dd34bd5458db9a3ef8f0095ff17e21fd1acb29b7
SSDEEP 192:sxZkRLWTg/fqsPkBXIdpd5HW6+WNGYaQ0VBIgrJ:sxZkEk/fqsPk2fHbGH9
TLSH
T13E12C8557E28A97B8CCBD21DBB29BF53D6F9503161D51E48AAFC862C04E6ACD130780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 10KB
SHA256 f4d80c33e3669f9df6b6b8ae3b2967784aac9cbedc50d59f42a996ea2e6bd46e
MD5 17b21bc9d96cc5b9b2834307ab27be41
SHA1 18e0659f8056b2469aef9c4b4c224413cfd19930
SHA512 5179620dbba351c9564c83066eec28b56793546b1a6afc2019628538db43653fbba2c5b008cb17116873edc5a574ef1fd0968d757d3e4f11085e5385a85ae85c
SSDEEP 192:sxZkRLWTg/fqsykBXIdpH5HW6+WNGYa+0VBIg5bJ:sxZkEk/fqsyk2ZHbG5X
TLSH
T15222D8557E28697B8CCBD21DBB19BF53E6F9503261D51E48AAFCC72C04E6ACD120780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 10KB
SHA256 ae076de39180afac69f883e340191443eb56a501f4d8bd796b07e2766adeb9be
MD5 4aca4dd5ad67b457179463fc6a485abe
SHA1 b7de45d4925f216734534be8a1071c97ef4eac05
SHA512 eb274b6b34a0a3827aed36f68e2a836462411f2076e405bb167843b5d4aca961a021641fbad9851fdcadd7386753a03960a9dc0594e7685c765a24a1cdc07a59
SSDEEP 192:sxZkRLWTg/fqsykBXIdpd5HW6+WNGYab0VBIg5bJ:sxZkEk/fqsyk2fHbGWX
TLSH
T18622C8557E28697B8CCBD20DBB15BF53E6F9503261D51E48AAFCC72C04E6ACD120780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 9KB
SHA256 1beacfb2fdae59da51bdc7cf200aa37b8cdda66ba3dbe8a6deca1389b34d0602
MD5 7918e6807f275844b975f09527772c31
SHA1 0cef409e068ca270b6eb4a5065506d60fe5d0de7
SHA512 b93b35266cee4addb545047b77a34ef303edebe94952b31b624a284b74d48c5abe16feb4004c5aae8559443f2f9a1047bad4bd63cb63553a688d407ee3903ff8
SSDEEP 192:sxZkRLWTg/fqsZkBXIdpd5HW6+WNGYaQ0VBIg5hJ:sxZkEk/fqsZk2fHbGHx
TLSH
T1A422D8557E28A97B8CCBD21DBB19BF53D6F9503161D51E48AAFC862C04E6ACD230780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 27KB
SHA256 f90c93a213d065b16c6b439d39304cb0be4196d6885dc19cf92f0088759c5b51
MD5 f952c45cea8d257a40613b4af510338a
SHA1 358b2cba9c7eacd25993c22e505b0d2083fb8bc9
SHA512 1d0c8934be692011891d8c5463c1892dafe01baef8ffc26ce1d03669c56aba029a189bb347174f76feef5c0b07fe8e2e32e303603c2f58d2ea725aa7b7359bd5
SSDEEP 768:efyQRbrWvvlpZ8F1+UoAYDCx9Tuqh0VfUC9xbog/OVaKLlRXH3xrorZc6:efyQRbrWvvlpZu1jaXKLf33KrZc6
TLSH
T19FC2FA2B640CCB7E4FC01E9DDC6A6F976EA802C766588D4447FA984C02C77EE512B4DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig~RFe59b8f6.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig~RFe59b8f6.TMP
Size 3KB
SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
MD5 904e6e94a1d46374c8630cfd86cc729f
SHA1 e1d9c3f7813878acc6510d48d95b2bf48b2e1a0d
SHA512 081e2a26252860ff8d8f7a9d0378ae56f0cc50574d13d2a121afdf74284963747ef874a4d73b1df7774cd8570972f4f513eefe0a0325fd088556d5b1ba946712
TLSH
T1DB815C4FCC0CBE77ABAB6A719A35D6B2F79131EA94518A977F8C444EE3050ED0242E50
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 12KB
SHA256 29fbfd68bc487c656e1267b189461eafdeb72fa9bb289f70ed806a35eb8e775f
MD5 8cb06d318d1e2e492483565ed95b8c79
SHA1 2a772d5f2d6c0b255ce9175614db914989c13e0f
SHA512 c6fcab95bf6b58472dd6a6c43eb59df36a500910cd41b7febeec4c01384e953c4efc2e18d814ec39da575299d4dbadb813a3a803b82df3c6f206cbd9b0ea2dc8
SSDEEP 192:u3t7sNUXvQ8LebKDPF7pQmiU15My54p5u88PRwKHPwoplAw/3FcjqCmf:EsNUXvHLe6FzRmp5u8iRwKHYoMOFc3g
TLSH
T105523A367878AC3B6DE29511F54A3A139FB8806BD7C82F88C5DC572D01DE29C5307A17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 4259aa4c04a62a1ec94faa106c44201da7e26d8dce47fb0308c0ebb010cb0c83
MD5 759804b4b3d8fb2d5b461cc226ee4416
SHA1 be5d951764665e371ad552fb1df6a506ae427c98
SHA512 4e7de1a3bd25d1af0479fe460235167c5c499857e3b14ebc46c5f81efba269f3f0075326577e9e7ef5fd8a396dbd15bb9d806e07f1c09971a477d51bf931a96f
SSDEEP 96:PqONkgQsjpfwDISp5ih/cIPURHl8h4otop5fmDqBfPGxvw45RxmJm78lFdx0Y++P:SONI6iDCQmiUyI6Hq5u88PRw7SqHoxU6
TLSH
T14802E8387C787CAB9DE26E15F5873B179FA8113FE6942F84C9E8162C01E769C1307922
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 12KB
SHA256 6ba503ccd48a25efa6b2f20a7d56524f70f3522168463b5708b4b77814c08db7
MD5 6c88f4db0d1170692e9b22b66a635177
SHA1 1fc05a286830ed7c7f25a6142843423c1758768c
SHA512 a6f74d873cc37a847074e6a6e0c10769d4f29326ee078c5d726ea0fe013b16022f13a09a46014d066634ebe7b6ccb7fb8e5813cfbdb4e3f7f5de116fd5543767
SSDEEP 192:uYjt7sNUEvQ8LebKDPF7pQmiU15My54p5u88PRwKHPwoplAw/3FcjqCmf:D1sNUEvHLe6FzRmp5u8iRwKHYoMOFc3g
TLSH
T19F523A367878AC3B6DE29511F54A3A139FB8806BD7C82F88C5DC572D05DE29C6307A17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 21KB
SHA256 4049418cac1531ced618deca7e530432f6a1a51734cbb5eb9f4457f511b88517
MD5 d956b0734b0d5d9518a4d0d6c721fbdc
SHA1 3a7b986057e575c9abf51c21d4e043622c936f51
SHA512 99adff8fc06924b9941256b8a9e20554ec835f42cd1eba1828c897aa14bdecc6bee5e90bc75fd3ed42c14caa4cdd0a25c3a4d5b1c99fe186dc310a9ef530a9e0
SSDEEP 384:LHiFiZcIcjsNc8TUNTUlIlEHHLe6FzRmp5u8iRwKHYo7OFcBkwc0a1oW:LCFQIZwgEBR0kRNzOGBkua1J
TLSH
T168A26D775CA4EC7BBDF69A51F54A3A03CEB880A7D7C8AB84D6C8971D01DA1D81307D22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 12KB
SHA256 8745ea96cc795018812c75d87db291e664890893ed530d1b18a70bec33e4ffb0
MD5 22b875e99f7aa71f70b040958b7c218f
SHA1 183a88fed20f5bd049d4c3109d3db7dea372970a
SHA512 545a38124dc2ab5189a9ed2398699b2c2dc35d2ac53693e65ec89c1b3e448e07c39800c83041bed7b7ecc02dfefb808e928f0beb51c47e5b930b67d5dc6dec40
SSDEEP 192:u3t7sNUXvQ8LebKDPF7+dQmiU15My54p5u88PRwKHPwoplAw/3FcjqCmf:EsNUXvHLe6uzRmp5u8iRwKHYoMOFc3g
TLSH
T157523A367878AC3B6DE29511F54A3A139FB8806BD7C82F88C9DC572D01DE29C6307A17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 9652ee3aa86ae15e8cc6cd04b1257a4c8c483d0328ab390bff1afd58e77af76b
MD5 627daa93fae812d00876d71c295e1cec
SHA1 8a50f684ddc31cd274827a2848e142110d7ef109
SHA512 b0eb2b541882e5be7bf17b30df2cdb21063b42a663f6beec694b5b2256f0d5a8c8e91b7ce2c2b5860448f101915543e8f0126bc4e3a6911aef764e1fe8afec13
SSDEEP 192:SONV6iDHQmiUyb36yq5u88PRwKHPwoGuZw/3FcU6:SONV6AWKyq5u8iRwKHYo5OFcU6
TLSH
T18A125C357878BC7B6DD26961F4873A139EA8412BEB886F85C8DC172C05EF69C5307A13
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 c590c9f58180668ee54c80f9fff15988e038b635cf3d638a64b799b99aca9fc7
MD5 afe655d8441c9a658d7fe5452af3d1d8
SHA1 69b44830438b2363be7823dc56bb7eaff31822c5
SHA512 71f60d8b838cba18ccca8378c6b5b71b8931ea02ec9e51203c124857924e10ee031142b9d1a1746a7cbbd061f0f0a89c7295baf943df4ad991b789c6e24cb2b5
SSDEEP 384:DCZcI5sNUEHHLe6FzRmp5u8iRwKHYoMOFcBkwc0a1oW:Dw5qBR0kRN0OGBkua1J
TLSH
T1F6927E752CB4AC7BACE6A551F44A3E039EBC806BD7C86F84D4DC672E01DA5981307E27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\metadata.json
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 03667c9c3c41a7d986c4a6c08826e128f3bdc0b662b5bfe4d3999899762f4abc
MD5 497a141890db70b84dcdc9f89c24c5f2
SHA1 92ddf9d0a66f6e5181218af3d66bdfec4c0c87a3
SHA512 c9dec026cd9bdaabcf052af6dfb31156c38b89bcdf781011b178203235f75e109bbd628aceae44642e67aced007f5b5dbaca6e4634189518d630143397591a33
TLSH
T1AD41275CBAF91148B3B76F169FF7A46D843AB8372E06D49D00110D4F0672A40C9A1737
MD5 SHA1 SHA512 TLSH

Submit Download