caf5909be93abc091eea1009dc36db7fed4b307b8fdb2d3c145102d65577fb4a

Analysis

max time kernel
148s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
22/09/2026, 12:20

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
index.html
Size 161KB
Sample260922-ph4lessyaz
SHA256 caf5909be93abc091eea1009dc36db7fed4b307b8fdb2d3c145102d65577fb4a
MD5 05f4d328b36a2775163ece536ffd1fa9
SHA1 593af6fc929015183b9b122cbd4c2f352d44c998
SHA512 751ff2a6a185caad821dfc8757f39681125db75d45a9985acb53506daaa44f2dd9dc6cd8025c059e4f2efb75ae6dcb541c902702608363831befb516d3c61d4b
SSDEEP 3072:EJkObE3CPD8AoIGlgZ/IPWoh8YG+/CgfmF+SIBzf6FuEPXaCEtQ:uxb9PD8AoIGlgZ/IPWoh8YG+/Cg6
TLSH
T161F3F9617B51187A313F53AEE057B60C219A9E53D74EA6E6F0FE805845E8FD231B230E
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
2968	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134345532568878847"	msedge.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-895009113-1202185046-1686627690-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-895009113-1202185046-1686627690-1000\{0DE0AD94-A782-4C6B-AA58-9E8FFA4A66B9}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
932	msedge.exe
932	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
1540	msedge.exe
1540	msedge.exe
1540	msedge.exe
1540	msedge.exe
1540	msedge.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
1540	msedge.exe
1540	msedge.exe
1540	msedge.exe
1540	msedge.exe
1540	msedge.exe
1540	msedge.exe
1540	msedge.exe
1540	msedge.exe
1540	msedge.exe
1540	msedge.exe
1540	msedge.exe
1540	msedge.exe
1540	msedge.exe
1540	msedge.exe
1540	msedge.exe
1540	msedge.exe
1540	msedge.exe
1540	msedge.exe
1540	msedge.exe
1540	msedge.exe
1540	msedge.exe
1540	msedge.exe
1540	msedge.exe
1540	msedge.exe
1540	msedge.exe
1540	msedge.exe
1540	msedge.exe
1540	msedge.exe
1540	msedge.exe
1540	msedge.exe
1540	msedge.exe
1540	msedge.exe
1540	msedge.exe
1540	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
1540	msedge.exe
1540	msedge.exe
1540	msedge.exe
1540	msedge.exe
1540	msedge.exe
1540	msedge.exe
1540	msedge.exe
1540	msedge.exe
1540	msedge.exe
1540	msedge.exe
1540	msedge.exe
1540	msedge.exe
1540	msedge.exe
1540	msedge.exe
1540	msedge.exe
1540	msedge.exe
1540	msedge.exe
1540	msedge.exe
1540	msedge.exe
1540	msedge.exe
1540	msedge.exe
1540	msedge.exe
1540	msedge.exe
1540	msedge.exe
1540	msedge.exe
1540	msedge.exe
1540	msedge.exe
1540	msedge.exe
1540	msedge.exe
1540	msedge.exe
1540	msedge.exe
1540	msedge.exe

Suspicious use of WriteProcessMemory 30 IoCs

description	pid	Process	procid_target
PID 1540 wrote to memory of 1012	1540	msedge.exe	85
PID 1540 wrote to memory of 3192	1540	msedge.exe	89
PID 1540 wrote to memory of 2968	1540	msedge.exe	88
PID 1540 wrote to memory of 3192	1540	msedge.exe	89
PID 1540 wrote to memory of 3192	1540	msedge.exe	89
PID 1540 wrote to memory of 1632	1540	msedge.exe	91
PID 1540 wrote to memory of 1632	1540	msedge.exe	91
PID 1540 wrote to memory of 1208	1540	msedge.exe	92
PID 1540 wrote to memory of 1208	1540	msedge.exe	92
PID 1540 wrote to memory of 1208	1540	msedge.exe	92
PID 1540 wrote to memory of 1744	1540	msedge.exe	93
PID 1540 wrote to memory of 1744	1540	msedge.exe	93
PID 1540 wrote to memory of 1744	1540	msedge.exe	93
PID 1540 wrote to memory of 316	1540	msedge.exe	94
PID 1540 wrote to memory of 316	1540	msedge.exe	94
PID 1540 wrote to memory of 316	1540	msedge.exe	94
PID 1540 wrote to memory of 116	1540	msedge.exe	95
PID 1540 wrote to memory of 116	1540	msedge.exe	95
PID 1540 wrote to memory of 116	1540	msedge.exe	95
PID 1540 wrote to memory of 1764	1540	msedge.exe	100
PID 1540 wrote to memory of 1764	1540	msedge.exe	100
PID 1540 wrote to memory of 3492	1540	msedge.exe	101
PID 1540 wrote to memory of 3492	1540	msedge.exe	101
PID 1540 wrote to memory of 4204	1540	msedge.exe	104
PID 1540 wrote to memory of 5376	1540	msedge.exe	113
PID 1540 wrote to memory of 5384	1540	msedge.exe	114
PID 1540 wrote to memory of 5392	1540	msedge.exe	115
PID 1540 wrote to memory of 6060	1540	msedge.exe	118
PID 1540 wrote to memory of 6060	1540	msedge.exe	118
PID 1540 wrote to memory of 932	1540	msedge.exe	124

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument C:\Users\Admin\AppData\Local\Temp\index.html
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1540
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x248,0x7ff85864c188,0x7ff85864c194,0x7ff85864c1a0
  2⤵
  PID:1012
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1744,i,11993858532780866812,10319178921112834407,524288 --field-trial-handle=2236,i,10293911980128653034,8152455438450987266,262144 --variations-seed-version --mojo-platform-channel-handle=2272 /prefetch:3
  2⤵
  - System Time Discovery
  PID:2968
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1656,i,1301008731330030410,16786241608029127330,262144 --field-trial-handle=2236,i,10293911980128653034,8152455438450987266,262144 --variations-seed-version --mojo-platform-channel-handle=2228 /prefetch:2
  2⤵
  PID:3192
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2472,i,3543363829353469399,11431396783606463528,524288 --field-trial-handle=2236,i,10293911980128653034,8152455438450987266,262144 --variations-seed-version --mojo-platform-channel-handle=3112 /prefetch:8
  2⤵
  PID:1632
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3456,i,4922554634830771852,13044033380045523967,2097152 --field-trial-handle=2236,i,10293911980128653034,8152455438450987266,262144 --variations-seed-version --mojo-platform-channel-handle=3492 /prefetch:1
  2⤵
  PID:1208
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3464,i,11857828765588970450,16359199293691973326,2097152 --field-trial-handle=2236,i,10293911980128653034,8152455438450987266,262144 --variations-seed-version --mojo-platform-channel-handle=3516 /prefetch:1
  2⤵
  PID:1744
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4204,i,15490207568966125288,16688129842380899192,2097152 --field-trial-handle=2236,i,10293911980128653034,8152455438450987266,262144 --variations-seed-version --mojo-platform-channel-handle=4236 /prefetch:1
  2⤵
  PID:316
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4252,i,2974747622539520234,13403875079256923323,2097152 --field-trial-handle=2236,i,10293911980128653034,8152455438450987266,262144 --variations-seed-version --mojo-platform-channel-handle=4244 /prefetch:2
  2⤵
  PID:116
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5176,i,12320297233306862965,16265526286443982046,524288 --field-trial-handle=2236,i,10293911980128653034,8152455438450987266,262144 --variations-seed-version --mojo-platform-channel-handle=5192 /prefetch:8
  2⤵
  PID:1764
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3492,i,11082053800364423530,14279171045530914753,524288 --field-trial-handle=2236,i,10293911980128653034,8152455438450987266,262144 --variations-seed-version --mojo-platform-channel-handle=5096 /prefetch:8
  2⤵
  PID:3492
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5904,i,1650090333075119232,12920156057050043247,524288 --field-trial-handle=2236,i,10293911980128653034,8152455438450987266,262144 --variations-seed-version --mojo-platform-channel-handle=5912 /prefetch:8
  2⤵
  PID:4308
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5904,i,1650090333075119232,12920156057050043247,524288 --field-trial-handle=2236,i,10293911980128653034,8152455438450987266,262144 --variations-seed-version --mojo-platform-channel-handle=5912 /prefetch:8
  2⤵
  PID:4204
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5028,i,10137236993406436519,17351935466865091048,524288 --field-trial-handle=2236,i,10293911980128653034,8152455438450987266,262144 --variations-seed-version --mojo-platform-channel-handle=4256 /prefetch:8
  2⤵
  PID:5376
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4240,i,6140485159752325544,738564575196838727,524288 --field-trial-handle=2236,i,10293911980128653034,8152455438450987266,262144 --variations-seed-version --mojo-platform-channel-handle=5020 /prefetch:8
  2⤵
  PID:5384
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4300,i,6831324823352293595,7445878803520321095,524288 --field-trial-handle=2236,i,10293911980128653034,8152455438450987266,262144 --variations-seed-version --mojo-platform-channel-handle=5960 /prefetch:8
  2⤵
  PID:5392
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5720,i,15593585703424950695,5750849319474027072,524288 --field-trial-handle=2236,i,10293911980128653034,8152455438450987266,262144 --variations-seed-version --mojo-platform-channel-handle=2140 /prefetch:8
  2⤵
  PID:6060
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=3668,i,35211510801041120,14939751964468567531,262144 --field-trial-handle=2236,i,10293911980128653034,8152455438450987266,262144 --variations-seed-version --mojo-platform-channel-handle=6196 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:932

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:1168

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 928eda824fe964cd23927cf06086d7d24e20a3a5092daf1acee5b632c76c962a
MD5 4ac43ee6512ba8635b7ba6bd015c291b
SHA1 5f9e2474b00ec0e2a9472c049fbea550e26309aa
SHA512 e5ebf9e92458f66e31e080121135313e828b8ebade0bc0e085221ae0d4f5afe0d2035c566590cbfb5902d96f17befe7b24310b4fb9e647b999113175af800ebc
TLSH
T17BD022B2B3A038CFE300083302A083BA2C0A80F300FAE2208C30E08C0BCC02AC283880
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 93c2ca3ce74eca17f27aa90cc3323bb8d6aea5c365862a01a512ce14b9f825b4
MD5 e8a3239e6b22580d77fb537c7bea1fab
SHA1 a99ffe9234c27e560f1c607d3b6c6507928368a3
SHA512 17b0e6f99943a02540148a685b91c62eafca3ef65d9a628bfb59d3b69a93b27c7d3ac42bdc808c52b5b1eac9bf4466a1099df17cd3f5df0bbd5b5282ca8b904e
TLSH
T170D0247133D03CCFD7000433015043751C0540F300F5D3104C30D04C07CD055C143440
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 b344a1b5343687d42fe90f79b63e94b2f5bc5df66f3def838a23fe4ac8dd055e
MD5 c859055d5b8d1a53328dcc78fc841656
SHA1 524e8517d59506d675b078b85276758b3358ec7d
SHA512 70e459b716a76b80042b4b7f67087f9d0c0c0c56ecbd8d1b0693b3dc1aad6c14363ba222e7952e19ad37c905811dd23718a7078d32b0272dfd24b12422dc7705
TLSH
T13A61EC806C404E65FF965F78A3F622FF35B5F0815AF3AD9D31B8C4799466758920434C
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe591d04.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe591d04.TMP
Size 3KB
SHA256 50a36873219472eec160cdaab23693fcb2c83dead3b9e41ab20feac0a8043e4d
MD5 d403e0cf4bffa7db2cf904f6a1e4ac96
SHA1 fed65fb36c307be911aad66d6f48a5fefae22877
SHA512 34c5b3d82da698c98ee03938cfad5bcdbcdca85a4a402d2f6bbf7174f6323c2d922d7d29e46983c13be65c2e0d083a10bf2c4f99c9a3d951397bb95d4a1187f2
TLSH
T17D61ED806C408E64FF965F78A3F622FF35B5F0815AF3AD9E31B8C879A466759920434C
MD5 SHA1 SHA512 TLSH

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 1KB
SHA256 1f5f896f6ca610907d39209ba6ed468050c4f33874b85be9a1a22ea73772eea0
MD5 055da1cc0a6fad3f1f26be2247bfcf36
SHA1 495437e2b3d677a3848dff193d9f5a394745bec2
SHA512 a88c02bcb9186d5ec4a8d106b0ca6724af6d026a39af1a7281650e72e432e3fb61c99c280a0204af1befb4b2ac6ba44563ae9024482b9fdd88eb10a18a9f4a4f
TLSH
T12E31AFF6C7D9836EC90156F05A24BE2BCE1D054A82283C1AC9E5EF5BA7E24F1E10255F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 9KB
SHA256 fdfd85cffc502b715e07eef9cb432d17e954857a98f7b40b1a54b2695b1e94ff
MD5 bf1537dbeb3b6edcf7043e75018f81eb
SHA1 af2d7b11d7e2f4bfef7ffa4b4748d922e46d076b
SHA512 68d069e46d6c18d09c776071b00d1fec94c02e3ac36915bc7f96c818b2b424b94c2d01e5c4bff47033c569afb244be6582520aef477be32e45e6a9d50d13ce9d
SSDEEP 192:sxZVR7Ww/fusw3IdpdKHW6+WNGY36aJlIgrJ:sxZVsw/fuswYQHbGX09
TLSH
T19512B712AE38697B8CC7D20DBA25BF53D6F9503251D51E48AAFCD61C05E7ADD220780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 9KB
SHA256 9e4a4c45f1f97092c65b830ffcbe62804fbc2f94704f71447c19d1d4ba2e8a5f
MD5 baa327299e13635798fba8006248de34
SHA1 ea55d35fc2211972f5e14221d241b5c6dbf45a73
SHA512 069a2e792078fee9dd2157ed5cf096df635ee79f8e0c3d70b686b22220cad6032da1d8790af285523f35ad69ce0d19f7105b97a253215341eed4b2a548803d27
SSDEEP 192:sxZVR7Ww/fusj3IdpdKHW6+WNGY36aJlIg5XJ:sxZVsw/fusjYQHbGX0H
TLSH
T12922B616AE38697B8CCBD20DBA25BF53D6F9503251D51E48AAFCD61C05EB6CD220780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 10KB
SHA256 ab7e39dc415057103bc3831ac1eebf76d2766ee5d0cf5535bf4ad92f0ea2b2ad
MD5 abee9d4c94184b4322af327845af4761
SHA1 5c516d8482dd87f069d4da64b5b147151a7d8cb9
SHA512 5a57c8cdc36f5f1b5693aa839711c684a3b2e9b41c0d3db2720dd74a4c0ed4b6220438534db87435ff4d7f4eff6dfd4f61aaacc492e1c21072230be0ff7e0a82
SSDEEP 192:sxZDR7Ww/fusmgIdpHKHW6+WNGY36/JlIg5lJ:sxZDsw/fusmhqHbGXP5
TLSH
T1F122C756AE38697B8CC7D20DBA15BF53E6F9503251911E48AAFCD61C05EBBCD220780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 10KB
SHA256 671ba76445ffff3a5731680596fd3e6035e05ec8b60daa2bc4530f4f0f7e8347
MD5 65c8cb5f349682dae7dec8bc1f72a5ff
SHA1 2535db7eea5157e37f2cc025d76586df8e20d804
SHA512 ad31edd3aa1516b1e26390cbda3085c13f6a27b5ab379e3722bdef0a79dc10cc1e8b20ee227cb23eeeb8dc69b67d4795ee6d3a6148a31fdcd9be0608d5449d84
SSDEEP 192:sxZDR7Ww/fusmgIdpdKHW6+WNGY36WJlIg5lJ:sxZDsw/fusmhQHbGXI5
TLSH
T16422B756AE38697B8CC7D209BA157F53E6F9503251911E48AAFCD61C05E77CD220780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 27KB
SHA256 74bebc9c347d93521c7729492dcadc34caf83b10dc57e0be1d6c866d07cfff12
MD5 195b25eebb0eef4d54abd6ba68fbabe8
SHA1 86d3d9a6c9fa3c0e9e5f4101d2545d751b282895
SHA512 e797d4f29365592769c832ff297700a72cb33044d6e87f4faa51d0c40c70240a62e5f30b30a184468cabe1fcc734de9b82be9fdc261eb96202f4017c53fe5376
SSDEEP 768:QaKlm7QWvUYe08F1+UoAYDCx9Tuqh0VfUC9xbog/OVh/LlpPs//rova:QaKlm7QWvUYe0u1ja8/L/E/sva
TLSH
T1EEC20A3B640CCB7E4FC05A9DDC5A6F976EA802C7A6588D4047FA984C02C77EE91264DF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 2KB
SHA256 1966af52fe6bcf1d726c77d6166d8749a2b7b12da536da1edf778eb54cdcde54
MD5 2e58ea20c927696dda8e592baf82c7e9
SHA1 6cfed200ed6b03a132bf092bf524906917407eb9
SHA512 dd59d4c40893b2ea5743d62f73793f0487e587957e8a1b588e31e8c8afcfc43a22849935f3211975a1ab1be40eb4fcac626dff32aa0a2f9ae70a85147f4344ad
TLSH
T139410143B0B66640383D251C80F59A1AC691B3A670ADEF7A77AB50550F3AE084DFCDD9
MD5 SHA1 SHA512 TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 2KB
SHA256 366f190cfacaec0dd08efc2faf2202d80720bf021135ea867f00884b9526e274
MD5 f16de7ad3b67df692f41ddef99e3f17e
SHA1 7428b5f9ed42723031cd7846cd057f195c10811c
SHA512 2c4f07af201da46ea36e3aa14dbb7d614bb8899853a88705ac5ce17f5b0bf805e21590d681f018dea5b2b1a31425fd2bcfbbb84241f22e5d4aa21d511824b9f3
TLSH
T1DB51F043B0B66651383D251C80F2991ACA91B3B270ADEF6B776B50650F3AE084DFCDD9
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 7df5f87bacdc413ad63c7513a791e2f22fcdefa243ba77deb986c730da58db38
MD5 45ef831f27850b0838d65e774b0f9ed5
SHA1 41b66afa164522d5d67a116a88ab70494b13bd39
SHA512 82f956f74f583037618aaeca90b6cc8058716d8d7cb306d1d992c4a7527b5da52f0eb56c4c4d4f5b513b711041c8a56129ad5244561bc49cf086eb6e54986f48
SSDEEP 384:iZcIhsNcoNcbo99h//Pe3RfxuvzxV+Mhdpsio2:QhQj/mRf4184psi5
TLSH
T1DD827B31AC796C7A5DABE181F88737134EB8816797C86F90D5ECAB1D00DA2A8231BC15
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 7fc655531435beb83a571eeebf34b7023258261332dcbfffdeaefc259f2597c7
MD5 fd56c2d872ae31fb1d3596fe0353c6de
SHA1 46484d58a76f03acb89cf1f36d4ac53af89979f9
SHA512 1dc3dea7d52b3597516521593b28d2dc7746c3b99c02245d3d40e8316658abe0ecca82fbdeb9cdfc91be25e4b1a0cc24c74855f7dbf7296caeeb3dde697dabb4
SSDEEP 192:BONX6JUm0QmiUyxOso//3ywvBCRX/VSU6:BONX6+mE3so//P8R4U6
TLSH
T1EA02E938BC687C7B8EF3AE45B44777235FA41067A6952F84DAE85E1D01D725C1307C26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 eb7e1a07631daf953a95555616075c92dea56a927ac3562ffa22a3a51deb1ca9
MD5 c7562a8316a81c380003114ebcc41607
SHA1 ccac45cfea98d86993369de9695117ccd56ac159
SHA512 3cbe5453845d02a66fa1d0c0841528f28ae297587b93b87a42ccc8a1af0d942c406dadf4d60393b70cd0b44bd01899e36fe8abdc51ea6c8f3eca48d8a9bc3726
SSDEEP 384:GZcIhsNcJNcbo99h//Pe3RfxuvzxV+Mhdpsio2:UhLj/mRf4184psi5
TLSH
T169827B31AC796C7A5DEBE181F88737134EB4816797C86F90D5ECAB1D00DA2A8231BC15
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 20KB
SHA256 545205c8b456b7913f6104747f65d52b04910cc789486238773bf860e2b6d499
MD5 9388585c22c68ae5c31ffc7c87b97cc8
SHA1 88b484ffce31fc946e0c486c26fd3682a21af466
SHA512 c8f402c290a5c7cf95749b3d1ac4263df6f627f3114e04e4094be3ff0cd467dfd79eda4601ee34ecadf00f5aa6f6dfb6ae1f19243677242d6f319473d3f798a2
SSDEEP 384:jFiZcIvzsNU8TUNTUlIlJNcbo99h//PenRfxuvzxV+Mhdpsio2:jFQLlwgRj/oRf4184psi5
TLSH
T1BEA25D729CA89C7AADFB9645F84637138EB481A7D6C4AE90E6DCEF1D00D71D8130BC15
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 4b30e9a698c9dd296e7317421ca5daa97acee037baaa219db111db02359f3e1b
MD5 a1b405aff3ad6ade387047c199a65370
SHA1 565d704404c4bb75cfa6a26df0097f9574c60189
SHA512 b01beaeb05b27ad80c068e3e424d340f9216943fb5d4fc06e922185ab998364b3c7b143b70731333a2ef046f61160231467f20fc1635e8b1343057f18817585d
SSDEEP 192:BON16JU1QmiUyuOfo//3ywenezdNxRnc/CU6:BON16+Tofo//PeIRfU6
TLSH
T1E0120935B878BC7B5EE3A994B48737135E644267DB896F80D6DC6A1C01DF19C130BC22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\metadata.json
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 b384ba0d62a7aa71a8291e8131039eaf17d8403634fa4d36d6f4d978eae45473
MD5 70dd3589b8c39df7e1f498d1840e0b35
SHA1 084905cb084c88f8886814bcdbb16e1890bc9c89
SHA512 320645d0f13c7d395dbb60d661d25b3e65f6a36c28178d43e25e72b0654ba7de5d47aa22fcea93cfa15a567905cb7e7f1da147055da3282757bb71a9cf21e3fa
TLSH
T1BB414A5CB6FE1148B3B7AE1AABF7A46D447FB8371E0BD45E10110D4E0666A40CC62737
MD5 SHA1 SHA512 TLSH

Submit Download