749126eb66a8a5e5eb19630c90dae604b41a53037466c8dc348fd31c1a2fb2c0

Analysis

max time kernel
148s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
30/09/2026, 06:00

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
749126eb66a8a5e5eb19630c90dae604b41a53037466c8dc348fd31c1a2fb2c0.html
Size 83KB
Sample260930-gqapbasele
SHA256 749126eb66a8a5e5eb19630c90dae604b41a53037466c8dc348fd31c1a2fb2c0
MD5 445c696d50a23df851434f854be998b9
SHA1 e7a9428cd2468779099d41522bb6d28166d21c44
SHA512 8bed02cd491a65c1cf6d49c8f167e802f7960284cdf4f89e0695a1513295456e2fe98f516917ccd0b7a700e54a88b1926af367d8213444333f6e4732163c1b0b
SSDEEP 1536:Lo4BRC6Hjq9yoUBOcpHXZ/YyDgj7WWOVFQi2C3gSrN:RRKUBHc6WO1
TLSH
T1CF83E8B9F1A170325A23F960402F500FB97B686BE44C09A8F254DCE0AEF59898577F6D
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
2636	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-240542094-4193773837-3211495583-1000\{44DED392-5755-4B82-879D-9C42411BDC80}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1428	msedge.exe
1428	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
2596	msedge.exe
2596	msedge.exe
2596	msedge.exe
2596	msedge.exe
2596	msedge.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
2596	msedge.exe
2596	msedge.exe
2596	msedge.exe
2596	msedge.exe
2596	msedge.exe
2596	msedge.exe
2596	msedge.exe
2596	msedge.exe
2596	msedge.exe
2596	msedge.exe
2596	msedge.exe
2596	msedge.exe
2596	msedge.exe
2596	msedge.exe
2596	msedge.exe
2596	msedge.exe
2596	msedge.exe
2596	msedge.exe
2596	msedge.exe
2596	msedge.exe
2596	msedge.exe
2596	msedge.exe
2596	msedge.exe
2596	msedge.exe
2596	msedge.exe
2596	msedge.exe
2596	msedge.exe
2596	msedge.exe
2596	msedge.exe
2596	msedge.exe
2596	msedge.exe
2596	msedge.exe
2596	msedge.exe
2596	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
2596	msedge.exe
2596	msedge.exe
2596	msedge.exe
2596	msedge.exe
2596	msedge.exe
2596	msedge.exe
2596	msedge.exe
2596	msedge.exe
2596	msedge.exe
2596	msedge.exe
2596	msedge.exe
2596	msedge.exe
2596	msedge.exe
2596	msedge.exe
2596	msedge.exe
2596	msedge.exe
2596	msedge.exe
2596	msedge.exe
2596	msedge.exe
2596	msedge.exe
2596	msedge.exe
2596	msedge.exe
2596	msedge.exe
2596	msedge.exe
2596	msedge.exe
2596	msedge.exe
2596	msedge.exe
2596	msedge.exe
2596	msedge.exe
2596	msedge.exe
2596	msedge.exe
2596	msedge.exe

Suspicious use of WriteProcessMemory 30 IoCs

description	pid	Process	procid_target
PID 2596 wrote to memory of 2268	2596	msedge.exe	86
PID 2596 wrote to memory of 2636	2596	msedge.exe	89
PID 2596 wrote to memory of 1860	2596	msedge.exe	88
PID 2596 wrote to memory of 1860	2596	msedge.exe	88
PID 2596 wrote to memory of 1860	2596	msedge.exe	88
PID 2596 wrote to memory of 816	2596	msedge.exe	90
PID 2596 wrote to memory of 816	2596	msedge.exe	90
PID 2596 wrote to memory of 4984	2596	msedge.exe	91
PID 2596 wrote to memory of 3984	2596	msedge.exe	92
PID 2596 wrote to memory of 4984	2596	msedge.exe	91
PID 2596 wrote to memory of 4984	2596	msedge.exe	91
PID 2596 wrote to memory of 3984	2596	msedge.exe	92
PID 2596 wrote to memory of 3984	2596	msedge.exe	92
PID 2596 wrote to memory of 3284	2596	msedge.exe	93
PID 2596 wrote to memory of 3284	2596	msedge.exe	93
PID 2596 wrote to memory of 3284	2596	msedge.exe	93
PID 2596 wrote to memory of 3256	2596	msedge.exe	94
PID 2596 wrote to memory of 3256	2596	msedge.exe	94
PID 2596 wrote to memory of 3256	2596	msedge.exe	94
PID 2596 wrote to memory of 3488	2596	msedge.exe	100
PID 2596 wrote to memory of 4092	2596	msedge.exe	101
PID 2596 wrote to memory of 3488	2596	msedge.exe	100
PID 2596 wrote to memory of 4092	2596	msedge.exe	101
PID 2596 wrote to memory of 2580	2596	msedge.exe	103
PID 2596 wrote to memory of 1272	2596	msedge.exe	112
PID 2596 wrote to memory of 1468	2596	msedge.exe	113
PID 2596 wrote to memory of 3800	2596	msedge.exe	114
PID 2596 wrote to memory of 1176	2596	msedge.exe	123
PID 2596 wrote to memory of 1176	2596	msedge.exe	123
PID 2596 wrote to memory of 1428	2596	msedge.exe	127

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument C:\Users\Admin\AppData\Local\Temp\749126eb66a8a5e5eb19630c90dae604b41a53037466c8dc348fd31c1a2fb2c0.html
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2596
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x25c,0x7ffd0016c188,0x7ffd0016c194,0x7ffd0016c1a0
  2⤵
  PID:2268
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1728,i,11096969401311315307,12071228331736434959,262144 --field-trial-handle=2928,i,17002572035607480552,4255341089447954068,262144 --variations-seed-version --mojo-platform-channel-handle=2908 /prefetch:2
  2⤵
  PID:1860
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1936,i,8461011758539770368,7668727553437148692,524288 --field-trial-handle=2928,i,17002572035607480552,4255341089447954068,262144 --variations-seed-version --mojo-platform-channel-handle=3004 /prefetch:3
  2⤵
  - System Time Discovery
  PID:2636
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2292,i,15598572476381851161,13155730768433121902,524288 --field-trial-handle=2928,i,17002572035607480552,4255341089447954068,262144 --variations-seed-version --mojo-platform-channel-handle=3044 /prefetch:8
  2⤵
  PID:816
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3396,i,4716109559511639273,1798937434764900633,2097152 --field-trial-handle=2928,i,17002572035607480552,4255341089447954068,262144 --variations-seed-version --mojo-platform-channel-handle=3472 /prefetch:1
  2⤵
  PID:4984
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3400,i,8985166289370992493,1151648597212431978,2097152 --field-trial-handle=2928,i,17002572035607480552,4255341089447954068,262144 --variations-seed-version --mojo-platform-channel-handle=3476 /prefetch:1
  2⤵
  PID:3984
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4048,i,15811020136267567213,10747757296884242348,2097152 --field-trial-handle=2928,i,17002572035607480552,4255341089447954068,262144 --variations-seed-version --mojo-platform-channel-handle=4080 /prefetch:1
  2⤵
  PID:3284
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4060,i,2803227104780097081,15973865206783444222,2097152 --field-trial-handle=2928,i,17002572035607480552,4255341089447954068,262144 --variations-seed-version --mojo-platform-channel-handle=2296 /prefetch:2
  2⤵
  PID:3256
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5112,i,4765400785094147134,11951413661266857356,524288 --field-trial-handle=2928,i,17002572035607480552,4255341089447954068,262144 --variations-seed-version --mojo-platform-channel-handle=5156 /prefetch:8
  2⤵
  PID:3488
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5116,i,3689343236418684647,17415927521095990242,524288 --field-trial-handle=2928,i,17002572035607480552,4255341089447954068,262144 --variations-seed-version --mojo-platform-channel-handle=5172 /prefetch:8
  2⤵
  PID:4092
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5920,i,2110291888576996950,4024605855527531689,524288 --field-trial-handle=2928,i,17002572035607480552,4255341089447954068,262144 --variations-seed-version --mojo-platform-channel-handle=5956 /prefetch:8
  2⤵
  PID:3116
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5920,i,2110291888576996950,4024605855527531689,524288 --field-trial-handle=2928,i,17002572035607480552,4255341089447954068,262144 --variations-seed-version --mojo-platform-channel-handle=5956 /prefetch:8
  2⤵
  PID:2580
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4044,i,16669102238678427816,17398485788962563697,524288 --field-trial-handle=2928,i,17002572035607480552,4255341089447954068,262144 --variations-seed-version --mojo-platform-channel-handle=4244 /prefetch:8
  2⤵
  PID:1272
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3560,i,14501227196851760152,12900637589056450638,524288 --field-trial-handle=2928,i,17002572035607480552,4255341089447954068,262144 --variations-seed-version --mojo-platform-channel-handle=4228 /prefetch:8
  2⤵
  PID:1468
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3376,i,12407405379351082308,16190878684189735344,524288 --field-trial-handle=2928,i,17002572035607480552,4255341089447954068,262144 --variations-seed-version --mojo-platform-channel-handle=5968 /prefetch:8
  2⤵
  PID:3800
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2128,i,17871869410477202669,17034252897412856677,524288 --field-trial-handle=2928,i,17002572035607480552,4255341089447954068,262144 --variations-seed-version --mojo-platform-channel-handle=3376 /prefetch:8
  2⤵
  PID:1176
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6204,i,11093420201138956756,13075560637443661427,262144 --field-trial-handle=2928,i,17002572035607480552,4255341089447954068,262144 --variations-seed-version --mojo-platform-channel-handle=756 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1428

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:3824

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 58b461967016818ce2213ba739aa830e079c4747cc98baea5feaffc8b09c915d
MD5 8800a672498272bad98dd79644e30101
SHA1 14a42c33d6271869cc680cadc5ae061e7092e3ae
SHA512 a17f90c73859841f3e0a3211d7f8d1027a7f8ec3a4ef87ddc96b1a39e0b52bc65decb3dd694a7092e22f06f2124864535e2e8632387dd42184abe2d3e22d7e12
TLSH
T135D022F2F32200E8C8C02A3C20030B080208C8000C833220C832C0C23ECCBC0A88F08C
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 7b81d8521f4289b1259fa60587a7bc7131f06581c3a734224a7de2fe2669bfb7
MD5 46bc1ee7f1b3386bbc305d48ade31614
SHA1 b5e469cf75c16715fb850bd86db01e329da2928e
SHA512 09a97914c725107f4c125aa0ff0826f0410030841011f0bc5c9eed9e023261ab13abc5f59c9c311d02baf1b25e7398de5ea81438c8a8ede3cc60ca3906edfce9
TLSH
T152D022F2B3A208E8CCC02A3C20030B080208C8000C83B320C832C0C22ECEBC0A88F08C
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 dbf56e87462a19a8d2d8b84a17d06027fd71037530eb3cb8386339f09916afb0
MD5 3dae5680e6c8f01b8b3be4a644e8eb0d
SHA1 c9cc151738a4a4c5391ed6e0ad281c2319abeded
SHA512 67960abfc56c842610caaba8f904e54e6e75768cb451e017d939132ed51892f2d4c32429d0b7930331ee580d901609925dbdccf084ef1dffca2aa756f36ddd98
TLSH
T15C611C88DBA0407BFB8AA07092DC108736FD408E57AFDF5A12F8ECF95F0A3617044114
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe59013e.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe59013e.TMP
Size 3KB
SHA256 697c8899403e91bb68a55cbc4e3c049bfd5c5e39d1d4abe38cb1912dbb147cfc
MD5 b7333316d90098b879becb7d1ebe11ae
SHA1 d28056a553493ca31bb45269a0c5fe77b2721663
SHA512 aea84991ae79ccaf03e6d91e0ffd772ad3e873c6f56760b06f8b819a67a00fc0fd1210864a6e8eeb6b5208936df0770712a860d16bf3e3c0c3efaed64294b425
TLSH
T113610B88DBA1407BFB8AA07096EC108B36FD408E57AFDF5A12F8ECF95F0A3617044114
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 1KB
SHA256 f7b12d0e8211e74425a7a0f3b01285b6d6b7e42b70e3603f183454195ccc8793
MD5 fe8adb49cf0f05cdfaec22e3f19e2d67
SHA1 7aff31c2ba442834beca1f483ac21d007e590063
SHA512 d3ae7caaa72602877385b4769b32b9293a8241cfe5f96b2a5899cb1620baffe939a830c71754232fa7304309c92c0073fe14f1ba7afeffd8fbb699097e45adb5
TLSH
T15D31AFB3C3D5866E890556F05A24AE3BCE2D064A822C3C1589E4EF6B93E2471D10159F
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 9KB
SHA256 b28295874a62ace0439ae2f0efb66e3b1bc45ef1a091748dc06cc2c9d734dcae
MD5 a843f3b46b2512f3453b521c4da88d12
SHA1 71991dc5a7d6f6e3abd054890162b3f178f6c00d
SHA512 c69f84abe2325179cdad926de84a2ce3d8be8bd4f83e81b387cca78b9768c7f3ec4907c955d5d7f188abc255c65435a5e5d412b1d5c47f9c531a5f9ffda258e2
SSDEEP 192:sxZQRJTWp/fusBPxLcIdpdSHW6+WNGYrbofIgrJ:sxZQGp/fusHxoHbGJ9
TLSH
T16422A7566E28A97B8CC7D20DFB25BF53D6F9503251951E88EAFC861C04E6ADD220780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 10KB
SHA256 7f884ecda65878948f4e939d17f32e201945a9f0d7d3da2b11a0402c98363a4f
MD5 501d9688cc23680980aa2640db46efce
SHA1 6b22757edf15743fc99910a094df0f33736ecaf2
SHA512 b65dc8be1866d7b7e6651d1d817adf65c848393cd28069ff02b2e70ac5878f0c3dba6748ea441d97b29a05570b19b1e682fca0e6af83a75d12e986410a899e23
SSDEEP 192:sxZQRJTWp/fusfPWLcIdpHSHW6+WNGYr1ofIg5UJ:sxZQGp/fus2xyHbGpi
TLSH
T16F22B856AE28A97B8CC7D20DFB15BF53D6F9503251951E88BAFC861C05E7BCD220780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 9KB
SHA256 03578709d6019677eb71fefd1ca36b4be3c84a2c468e5d5de49a5be4a1171b8b
MD5 2311ef97e0a769b7e3be80f479d02a99
SHA1 08cb19e481346a48098ec9a41086d94dbd6b6e8c
SHA512 913e292eaa610d2ec0ddf98285201c8990ed9778e116b0cdd014d1257bbca3a1e6f49a0443393ecedd3f027ebcefd1175fcdfcedec093157fafae726c6bbeb47
SSDEEP 192:sxZQRJTWp/fusfPxLcIdpdSHW6+WNGYrbofIg5+J:sxZQGp/fusRxoHbGJ4
TLSH
T16222B756AE38B97B8CC7D20DFB15BF53D6F9503251951E88AAFC861C04E6ACD220780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 10KB
SHA256 5f3f8e0389f75f1c42d65a6cbac634c1dbaba0ec457cbc623c3b27c9c96b26e7
MD5 40cfc40caa718621c59772a91ac0b7da
SHA1 383a62ab179ea07958299cca72db8bffa1c8835a
SHA512 085444efc81a2338a3793462068c3505d7ab1b33259cfbbd1ba61ede20456df0c0ff74f974a01bc860670f40c9c31cbfb02df090d2bc4ec39a315df79715de8e
SSDEEP 192:sxZQRJTWp/fusfPWLcIdpdSHW6+WNGYrEofIg5UJ:sxZQGp/fus2xoHbGui
TLSH
T1EE22A856AE28B97B8CC7D20DFB15BF53D6F9503251951E88AAFC861C05E7ACD220780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 27KB
SHA256 47f150f6a3845c8732fc877fd4c9b2f3ec77dab96175a3a0d327078aeb2fa2bb
MD5 b1a94ac4ecba37facdd46746158df1b8
SHA1 92cfe6f532d523f68a41bbade06f779fa4817f7a
SHA512 68fc2469378364109a9045c4deba2c34f0db97929dab1c29058472a4490c389e597513ff75b5a4db91b49d1669147f0224ee65cc9a4a688a3236861276222de0
SSDEEP 768:dSy4J/DWvbtBh8F1+UoAYDCx9Tuqh0VfUC9xbog/OVCiLlc2TbGroRVF:dSy4J/DWvbtBhu1jajiLm0b9fF
TLSH
T153C2FB3F644CCA7E4FC00A9DED5E6F973E9802C79A948D4047FA994C02C77EA51264DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 81148b68a3c987fe275902d24b9c164e68ec2246c075925ff3951d7eeeda6c36
MD5 ebe1d596497101b0eb55ce519796bdab
SHA1 dcc913dfcf206428c75bb1e9e014b0e71ea8324a
SHA512 4723868ed5224639bd611807ed27a1d8433ab59c434b878e954240adbe4ee37ebaf70a60c24ef7ca7f36f0c3af39fe05df275f91cbcdaded9eaad671f842d166
SSDEEP 48:KIDI1Ks04jyL2xMwuUUNb4PgISINK9s1uNxmdYHY02yLdcRtfLPwbD2jISlwK9lF:KIDCKs0+WheKiwKaq0KziHw
TLSH
T124913E4435BF020539BD2A9881758B5F524132B73118EA3B7FBD40669E2FE085DFD8C9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

d24957a7-02be-482f-957f-7c98f26d6434.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\d24957a7-02be-482f-957f-7c98f26d6434.tmp
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 64dd7809fadb95437158ddef77fcbbc1e09e6f5c69eb578839ee8809150be3a3
MD5 6a8d40136deb6288be2fed4f513883df
SHA1 384351bddd0bf1ad2cda318d8e52e2c3cf9b75b3
SHA512 68b7cda3b08e83f9ea9a2e7d584bb900a9a37df706a5dbdf67fd501ace839e7309aa4b2291b24602453fc7c45ae5d4c681331d3e11f965a2a623410f62662463
SSDEEP 384:fRZcIhsNdkDZ0BeHX58EMOzAAQfAVZh6DKhHnog:f5hxiYaHOZQfAfYGHnf
TLSH
T187828D72E878AD765DFAA145F54636039FF88063E3896FC4C1DCAB1D00DA6AC1317E1A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 b1d4b399c562206dd7d900a5272a2433f4341baa4eeb36e1ee93c5493d1c3cd0
MD5 5906ab31a25e89367b54159449851730
SHA1 cb95ffd988af35ae31176047dc394f71e887cd41
SHA512 1835fe9b37f540e365e8d69ac3e8140ac259471e9f307fe9bb288d79c498c03a05a5b9f28b3cc5f4befe114633a4829268ed7f4ebed70e7b9d699abf60e45b43
SSDEEP 192:1ONf6wlDgQmiUyFvW4X58gZMOKoAaDlLqnU6:1ONf6kgCW4X58EMOzAq6U6
TLSH
T1DF02E935B9687C7B8EF2AE09F58B27139FE5106BE5512F84DAEC1A2D00D775C2307922
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 21KB
SHA256 394ed80d5b40b3bd5a693f596d661b7114ab41bc0427ca6c48ebed7ab2475fa0
MD5 4cae3e74155d7b820ef95a15a42c9728
SHA1 fe67e8d06b6ab7ea124e49cc9c75f175a33e1f58
SHA512 e15718223003cb4291718b35daba21feb71259921bcf034f4383a2384f91faebe215eb1c8be7093e3ab95f97f8ead404ebd9a2f091ce343cba8e78e75d96ff7c
SSDEEP 384:ChiFiZcIpzsNn8TUNTUlIlRDZ0BeHX58EMOzAAQIAVZh6DKhHnog:CIFQJywgriYaHOZQIAfYGHnf
TLSH
T169A26C7398A8DD7B9DFA9A45F94636039FF880A3D685AED0D2CCAA1D00DB1AC1307D15
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 b83d776e8e3fd5b9ee0a0d32bb30f26d9c1b41f2e823202300f1cbb24eb98758
MD5 d07abf3ab6ab7e31563be3c84e2453a6
SHA1 0eec4829f5ae9a2360bdfbb6f89f9f12c66ef48e
SHA512 e24f0cfef2382de40489c7704b05a1c0cf95f07f0c99a205f8c5ccf1d0ea4330cbf800c8373e57d49d6a0868ec6dc0ce2ee285cc034ea1c0f565c7c4183e0fbb
SSDEEP 192:1ONhS6wlDfQmiUyzva4X58gZMOKoAAQEve5qBU6:1ON46khOa4X58EMOzAAQvAU6
TLSH
T1E4120836F8A8AC3B4EE2A544F58735139FA95127EB457FC0C6DC2A2C01DF66C130B816
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 cb7a52e37288a7273a6b005b77ff47976d8617bb6b714b2cbea9905af50b0ed8
MD5 1f5a976f642b428f2a9b3e0a075dad0a
SHA1 9be4804717e1ca4e80439c349712e99848c06cc2
SHA512 ab3c0973ca9fcafeda0fcb2437eb12e1973b8b09824e8f74d8cfc2e0a7997a0e97202a90229f961fa61299d07bc00d518ab7ba5c828e2af1af00c57d3bf410d6
SSDEEP 384:qRZcIhsNdRDZ0BeHX58EMOzAAQfAVZh6DKhHnog:q5h+iYaHOZQfAfYGHnf
TLSH
T15C829E72A878AD764DF6A145F54636039FF88063E3C96FC4C1DCAB1D00DA6AC1307E1A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

15b489f9-1095-4270-a0fd-6fc42e9ad1f9.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\15b489f9-1095-4270-a0fd-6fc42e9ad1f9.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 feb019becdd71efbf0e3bf13ec73211a51c791f6f5697e10067ed1cc6b9e1453
MD5 2c517d1441b6b13d7a9c59a8f9a74f68
SHA1 4ef7fc57ba3130893fe2619ed6b913cedaab3367
SHA512 843ce9be41cabaa929dd4c8b7016853e127e74781796eb39c8fcf5ca278741029ca48c42d4947d29f526ae40274311f27d11c2fd8ec902cd46aa42160ef2310c
TLSH
T16F411A58A6FD1108B3B7AF1AABF6A46D447BBC772E4AD45E10110E4F0A26B40C872737
MD5 SHA1 SHA512 TLSH

Submit Download