hxxps://products[.]office[.]com/en-us/CMSImages/Office365Logo_Orange[.]png?version=b8d100a9-0a8b-8e6a-88e1-ef488fee0470

Analysis

user interaction
yes
max time kernel
148s
max time network
143s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
30/09/2026, 13:27

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://products.office.com/en-us/CMSImages/Office365Logo_Orange.png?version=b8d100a9-0a8b-8e6a-88e1-ef488fee0470
Sample260930-qqlagsyzhy

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
5052	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2101206053-1414382737-268919432-1000\{2BB831F3-A9E1-4854-8961-07FE55182A87}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4460	msedge.exe
4460	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
2708	msedge.exe
2708	msedge.exe
2708	msedge.exe
2708	msedge.exe
2708	msedge.exe
2708	msedge.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
2708	msedge.exe
2708	msedge.exe
2708	msedge.exe
2708	msedge.exe
2708	msedge.exe
2708	msedge.exe
2708	msedge.exe
2708	msedge.exe
2708	msedge.exe
2708	msedge.exe
2708	msedge.exe
2708	msedge.exe
2708	msedge.exe
2708	msedge.exe
2708	msedge.exe
2708	msedge.exe
2708	msedge.exe
2708	msedge.exe
2708	msedge.exe
2708	msedge.exe
2708	msedge.exe
2708	msedge.exe
2708	msedge.exe
2708	msedge.exe
2708	msedge.exe
2708	msedge.exe
2708	msedge.exe
2708	msedge.exe
2708	msedge.exe
2708	msedge.exe
2708	msedge.exe
2708	msedge.exe
2708	msedge.exe
2708	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
2708	msedge.exe
2708	msedge.exe
2708	msedge.exe
2708	msedge.exe
2708	msedge.exe
2708	msedge.exe
2708	msedge.exe
2708	msedge.exe
2708	msedge.exe
2708	msedge.exe
2708	msedge.exe
2708	msedge.exe
2708	msedge.exe
2708	msedge.exe
2708	msedge.exe
2708	msedge.exe
2708	msedge.exe
2708	msedge.exe
2708	msedge.exe
2708	msedge.exe
2708	msedge.exe
2708	msedge.exe
2708	msedge.exe
2708	msedge.exe
2708	msedge.exe
2708	msedge.exe
2708	msedge.exe
2708	msedge.exe
2708	msedge.exe
2708	msedge.exe
2708	msedge.exe
2708	msedge.exe

Suspicious use of WriteProcessMemory 33 IoCs

description	pid	Process	procid_target
PID 2708 wrote to memory of 548	2708	msedge.exe	85
PID 2708 wrote to memory of 5052	2708	msedge.exe	86
PID 2708 wrote to memory of 4084	2708	msedge.exe	87
PID 2708 wrote to memory of 4084	2708	msedge.exe	87
PID 2708 wrote to memory of 4084	2708	msedge.exe	87
PID 2708 wrote to memory of 4504	2708	msedge.exe	88
PID 2708 wrote to memory of 4504	2708	msedge.exe	88
PID 2708 wrote to memory of 2068	2708	msedge.exe	89
PID 2708 wrote to memory of 2068	2708	msedge.exe	89
PID 2708 wrote to memory of 2068	2708	msedge.exe	89
PID 2708 wrote to memory of 5072	2708	msedge.exe	90
PID 2708 wrote to memory of 5072	2708	msedge.exe	90
PID 2708 wrote to memory of 5072	2708	msedge.exe	90
PID 2708 wrote to memory of 3596	2708	msedge.exe	91
PID 2708 wrote to memory of 2044	2708	msedge.exe	92
PID 2708 wrote to memory of 3596	2708	msedge.exe	91
PID 2708 wrote to memory of 3596	2708	msedge.exe	91
PID 2708 wrote to memory of 2044	2708	msedge.exe	92
PID 2708 wrote to memory of 2044	2708	msedge.exe	92
PID 2708 wrote to memory of 1268	2708	msedge.exe	96
PID 2708 wrote to memory of 1268	2708	msedge.exe	96
PID 2708 wrote to memory of 1268	2708	msedge.exe	96
PID 2708 wrote to memory of 3468	2708	msedge.exe	99
PID 2708 wrote to memory of 4696	2708	msedge.exe	100
PID 2708 wrote to memory of 3468	2708	msedge.exe	99
PID 2708 wrote to memory of 4696	2708	msedge.exe	100
PID 2708 wrote to memory of 4172	2708	msedge.exe	102
PID 2708 wrote to memory of 4992	2708	msedge.exe	114
PID 2708 wrote to memory of 5036	2708	msedge.exe	115
PID 2708 wrote to memory of 2188	2708	msedge.exe	116
PID 2708 wrote to memory of 4016	2708	msedge.exe	124
PID 2708 wrote to memory of 4016	2708	msedge.exe	124
PID 2708 wrote to memory of 4460	2708	msedge.exe	128

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://products.office.com/en-us/CMSImages/Office365Logo_Orange.png?version=b8d100a9-0a8b-8e6a-88e1-ef488fee0470
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2708
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x260,0x7ffa9cb6c188,0x7ffa9cb6c194,0x7ffa9cb6c1a0
  2⤵
  PID:548
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1904,i,15441216090756091126,14456347930751688535,524288 --field-trial-handle=2244,i,2105341709608486960,9547017679113836013,262144 --variations-seed-version --mojo-platform-channel-handle=2280 /prefetch:3
  2⤵
  - System Time Discovery
  PID:5052
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1620,i,18386071319743797676,8990711485747232074,262144 --field-trial-handle=2244,i,2105341709608486960,9547017679113836013,262144 --variations-seed-version --mojo-platform-channel-handle=2240 /prefetch:2
  2⤵
  PID:4084
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2584,i,15641525660421716261,12630621927625278408,524288 --field-trial-handle=2244,i,2105341709608486960,9547017679113836013,262144 --variations-seed-version --mojo-platform-channel-handle=2588 /prefetch:8
  2⤵
  PID:4504
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3432,i,8817344228577683458,10215946918580599705,2097152 --field-trial-handle=2244,i,2105341709608486960,9547017679113836013,262144 --variations-seed-version --mojo-platform-channel-handle=3336 /prefetch:1
  2⤵
  PID:2068
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3436,i,12291329538049678942,2392979370077654933,2097152 --field-trial-handle=2244,i,2105341709608486960,9547017679113836013,262144 --variations-seed-version --mojo-platform-channel-handle=3464 /prefetch:1
  2⤵
  PID:5072
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4196,i,5724273555024049649,10975654166218396207,2097152 --field-trial-handle=2244,i,2105341709608486960,9547017679113836013,262144 --variations-seed-version --mojo-platform-channel-handle=4212 /prefetch:2
  2⤵
  PID:3596
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4176,i,6541052108740196126,10630790356414558801,2097152 --field-trial-handle=2244,i,2105341709608486960,9547017679113836013,262144 --variations-seed-version --mojo-platform-channel-handle=4244 /prefetch:1
  2⤵
  PID:2044
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=5048,i,3170353628250103190,7287664967703036251,2097152 --field-trial-handle=2244,i,2105341709608486960,9547017679113836013,262144 --variations-seed-version --mojo-platform-channel-handle=5056 /prefetch:1
  2⤵
  PID:1268
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4312,i,11151741486130117230,14787277895253557242,524288 --field-trial-handle=2244,i,2105341709608486960,9547017679113836013,262144 --variations-seed-version --mojo-platform-channel-handle=5228 /prefetch:8
  2⤵
  PID:3468
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5244,i,11402064825389051416,8416884743996187820,524288 --field-trial-handle=2244,i,2105341709608486960,9547017679113836013,262144 --variations-seed-version --mojo-platform-channel-handle=5276 /prefetch:8
  2⤵
  PID:4696
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5912,i,17909512780864628991,11932932312710366816,524288 --field-trial-handle=2244,i,2105341709608486960,9547017679113836013,262144 --variations-seed-version --mojo-platform-channel-handle=5936 /prefetch:8
  2⤵
  PID:3816
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5912,i,17909512780864628991,11932932312710366816,524288 --field-trial-handle=2244,i,2105341709608486960,9547017679113836013,262144 --variations-seed-version --mojo-platform-channel-handle=5936 /prefetch:8
  2⤵
  PID:4172
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4420,i,5177215624281746229,3550308457350834776,524288 --field-trial-handle=2244,i,2105341709608486960,9547017679113836013,262144 --variations-seed-version --mojo-platform-channel-handle=4396 /prefetch:8
  2⤵
  PID:4992
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4404,i,2674359880321925234,3548358245760976180,524288 --field-trial-handle=2244,i,2105341709608486960,9547017679113836013,262144 --variations-seed-version --mojo-platform-channel-handle=4332 /prefetch:8
  2⤵
  PID:5036
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4408,i,45399269662085481,15548147825505831769,524288 --field-trial-handle=2244,i,2105341709608486960,9547017679113836013,262144 --variations-seed-version --mojo-platform-channel-handle=4348 /prefetch:8
  2⤵
  PID:2188
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5296,i,14797101153680202908,12001832531476067683,524288 --field-trial-handle=2244,i,2105341709608486960,9547017679113836013,262144 --variations-seed-version --mojo-platform-channel-handle=5480 /prefetch:8
  2⤵
  PID:4016
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=760,i,6714616858493092547,8694118462302796556,262144 --field-trial-handle=2244,i,2105341709608486960,9547017679113836013,262144 --variations-seed-version --mojo-platform-channel-handle=3700 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4460

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:4912

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

blocklist

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\blocklist
Size 105KB
SHA256 33216cc8094343b1e673d6d0ce51864cf882b00961e3411c47b6a0cf1488a291
MD5 67f6e997d9180458e1a8c1eb8facdbb8
SHA1 ba71d9acfdbf5ad19e98c71c4ff3936488e5302e
SHA512 cc39dc134ebb79f6ba88453b88057a692c89209ccaada0ea03ca92512d41d4b9cea1179950cf85647315f4dd3a45c3553a403d01ea2891cbdb3b8df87cb294a1
SSDEEP 1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P7z:fwUQC5VwBIiElEd2K57P7z
TLSH
T16AB3B931457E36BF26E93EE828CF1511B84F3912624895D4ABE1FE2C4845E68633CEF4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 2b6f38f22081ddaa1111b84705bb0452e935cba70ffda2b2886601f1d8df6360
MD5 ec02b779d41e6c7bfde9a979b0a24d5d
SHA1 d7bfaab5e399fd543bd91b28be91cb05e1603c12
SHA512 7039abea8da570fee0fd1cebc7e8feacc30cdd16fd0348ba5146c309f1696c541bd99a85a480ad3c227df6df586718bd26cf483ae0af65010caac2db1bde30aa
TLSH
T156D02BC8D0D43558E01630351027850233CCDD54F003224680450591C4402C205F0869
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 4953eb47ddf8fed591c7d8926a102a58328776c2f8bcb0dcc6c2f6f790020aa9
MD5 4dce79f6f910909bafe5b8817320847d
SHA1 e10678ff1c26e3e9d2f3bf3bb824dc7adf3c47e4
SHA512 9329ecf2bfca29939d71c91b740a18344d0c73d558771b355af8d5bafc3d053fd9c23a07e1db9b22bfa7909d7bb78bb5272f713dbfc950acdbf066383642330d
TLSH
T146D02BC890D43958E41630351026850233CCDD54F003234780450591C4412C205F0869
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 91c8a97220ccb4e9f6b30cc0f93a680c28b8f3d999ad4b98ee0e95e00c0a1220
MD5 c6601a43bf02e8af8648fe7e8174250b
SHA1 3c162c06049a4928a206333d12451f0c5a306081
SHA512 135a889422719dc8485ce2b74387f3d8ccd9bd36f85a891657d942814589a6200311f824d9ca265a6c441462950a153caeeae94554982cd4b9c2b3c8841f71e7
TLSH
T11E61F586ED50E4E3FB989130A9FF258AEA6545B0988F2D3200AEF5FDEF15B9C5004074
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe592d21.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe592d21.TMP
Size 3KB
SHA256 f14da874d94c72bca72d5faebb8f867c1f70d1ab4c46e1eb352e6055f41201e9
MD5 3f8a266921d371cfc81850555c8c9694
SHA1 0b83edab2b7494d2fcc262ecf7ceb3c1db0df2d0
SHA512 cc7511b59d0a639780f23290299fdb3d79ce6dbf9eb328a8c4741016ed03c6c27af03511fa26e1f129c115abe64e7e5ccc9b2459c2f39f13fee094944a8e8a1d
TLSH
T16561F686FD50E4E3FB989130A9FF258AEA6545B0988F2D3200AEF5FDEF15B9C4004074
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 1KB
SHA256 14b0ca887382c91d98ca4bdb2d801501744c2484df47d9624a24f4eaa949b5ee
MD5 285b0aa6b61f14df7d8e8aebc256b92b
SHA1 abe866a7a9d0deb52e37c598f3fbe77d9dd2341d
SHA512 c978bdf7fa75767848a88ee6070dcadc6b1e29c647163795736bfa2f8055236576fc7b1b7a1934530d0d7cd4a4dfd0420bd66aa4a1481f22e755d7b026e83483
TLSH
T17E21BEF783A0456ECA0256F09A14BE2BCE2D0546435C7C6986D4EF27D3F3566E10259F
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 9KB
SHA256 c058c24715905b6bbc61add6ebfb77fede8720a5715c9f4836475a6cfa0e0839
MD5 b968af2600bd7cb02781f8b6b8b0eba5
SHA1 f514722ed64996fe6fae00196d8009cb1127b546
SHA512 42e51157c83355b7b5d7a02c27068acb0663e16fd47a1286bd34beb414e78184a451a41c21cbf00a1bfdcd06a4912cd68bfbf179a4b062259ff2cc75f3e121c1
SSDEEP 192:sxZRRzWe/f5suRrIdpmlHW6+WNFYI/YaAZKIgrJ:sxZR4e/f5suR0yHbl/t9
TLSH
T15522B8566E28B97B4CC7D20DBA25BF53E6F9503291D51E88EAFC861C04E7ADD120780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 10KB
SHA256 63118aa5a33980552d22561bafd4cbed16cb03c97cd59f7edd050bd4a26be682
MD5 254e46a621363e0c79df80c8e1078351
SHA1 8052d7786e68feda6e869f98572d63238be30f38
SHA512 c1b5c0d2aa8208250c997107909a338de0fec7e1333413ea2160c375d661754f4c6a93baa1f7a717bd7ecd52f123162b2ed67d9ed101f64085a9f08d205dcf51
SSDEEP 192:sxZRRzWe/f5sWRrIdpQlHW6+WNFiIXYa6ZKIg5/J:sxZR4e/f5sWR0AHb/XjP
TLSH
T14722DA526E68A97B8CC7D21DBA15BF53E6F9503295D11E48A6FC8A1C04F7BCD220780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 10KB
SHA256 ded2c0ae9131f89ee647b5ce90cad7cc8b6bea7407a4663d3c7f3078ffd0ace2
MD5 9f7d7f8012787f77ab42f23c8d86189e
SHA1 20dfb11a6f55a38c18d8c3ae3c9f046d3f5f5da1
SHA512 034d23924ab43b3bba058c802e89e04dbcdfd57def9a00547d6642758b3d523e863babdd766be1a6c073401aa8cc3d6381b5b54b185aa919bba91a5ee6e76a50
SSDEEP 192:sxZRRzWe/f5sWRrIdpmlHW6+WNFiIXYaOZKIg5/J:sxZR4e/f5sWR0yHb/XvP
TLSH
T19222C9516E28A97B4CC7E21DBA15BF53E6F9503291D51E48A6FC8A1C04F7BCD220780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 10KB
SHA256 931a4621c41d6149889961f4895dce87283f64292bfd43b21fdc2e0ee2b2ecd3
MD5 db125336688d85b98d1f4773a735315d
SHA1 f628cc0c86a609651fafdc5d98f8bc52ffb33e52
SHA512 ffcab9ee4fc5489b9fa8a57d4702eb7f558c499ff30a8dad608fa8ffb9ec1058f890e1e40490f172c284ae9ae2ea7e2beea302db96502cc3790e12633da86b23
SSDEEP 192:sxZRRzWe/f5stRrIdpmlHW6+WNFiIXYavyZKIg5VJ:sxZR4e/f5stR0yHb/Xnz5
TLSH
T1D222CA556E68A97B4CC7D21DBA15BF53E6F9103291D51E88E6FC861C04E7BCD220780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 27KB
SHA256 726fff81222c52aa59d455b82c0e432054d28e06234a20d6bafefec09d9f4351
MD5 f8ad3ffb783089187406e3f585dbafac
SHA1 ef9471dce033adab086602cade6f55106b573e92
SHA512 125c1704d92ced7eb103a0ad8fe14cad83c3cc2dfb5e7180a315ca6bb758fca72e1e3ef226966c7a77056ff69ac06ff02e0026ef9a70275d769f56e90eda8003
SSDEEP 768:hiyQRbrWvvlpZ8F1+UoAYDCx9Tuqh0VfUC9xbog/OVaKLlRXH3uroTZ3K:hiyQRbrWvvlpZu1jaXKLf33lTZ3K
TLSH
T15AC2E92B640CCB7E4FC01E9DDC6A6F976EA802C766588D4447FA984C02C77EE512A4DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 6031ac88078cb7628c88c1839db37fed219527a1d069fcbdace735886d1e483a
MD5 9af21ec6c2481979e41f54a8e5cf156a
SHA1 f2afd4c606be8a2fa425a7729928c263c9b18260
SHA512 1f9fd1597604e0ea33e1ebcce1006a0a81e4150268f70263ca10ac0cb785eca3f24a757781274e844cc7acf26fe89df367aa5ea85bb97a4c189c86660ca4ee63
SSDEEP 48:K0ydgMyQwBbsbcISkBK9o1yBxKRYTkQCyL+5UY28slbQ3YISwlK9U1mlxe1YPQAT:KYduKGwC2JSK60dvyKc4CSz
TLSH
T10F910501357B024138BE798880A8DA1E954136A3355DF96F7FBC51674EABE085CFF8C9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

fd396346-b2b6-4d85-aefe-fa4d032b24f0.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\fd396346-b2b6-4d85-aefe-fa4d032b24f0.tmp
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 91af13990a26cdca553d21076b9a0a9d8371f3061d0e07018982a27a53c4fc5a
MD5 68a90edb76b1bce24431e732ce616d2f
SHA1 53a8c99e5866bc0c21904df325aaa9636c44cd19
SHA512 d4685b37d3e6535aa75e6379a8e613e313b1dc97768dd4098d6ad301bf207477e6ea21d1372bd091ac01b35267b1e5b25619bdf70445e7dbc61c0e225489cd62
SSDEEP 384:4ZcIhsNVXkRH4E4p5u8i4t/htgOIwZOy1L9oO:GhByk6hXsOZJ
TLSH
T182828D369CB86C7A6CE7A545F58B32035FB88167E3C8AB94C5EC571D01EB298130B913
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 26KB
SHA256 427c4f0daa738c4e3978b9757008a4f434a797e2ab5c9f61a0b34ade3dfc434c
MD5 26b8321d4747066452ade603cf7f47c3
SHA1 a4fc5b8837713039290a73ca24f440091f52bb2b
SHA512 c15b27831027db2b1a44b2f558223502d9a9d347701b7c7536706209aa8be4afe7f87f3fc8d69b63f480749113eef96b3aad2c6b7058a50d0b128d79361b9bee
SSDEEP 384:OiFiZcIDzsNv8TUNTUlIlckRH4k4p5u8i4tKhtgOIwZOy1L9oO:lFQHSwgzykthXsOZJ
TLSH
T130C22AF248E7987AE8AE5743A77E2D034EBCC167F284A650B3D8461DCC961BFC306911
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 9409f2facf65deb0453216594e183d184cbeec49bbef598dc8832c16d4872ef3
MD5 2bee4467411e3d89e47b9fccb82e4c97
SHA1 f024c95d238226271df865b583ecbc7ba42493a2
SHA512 a74bae418e35380023f8c38ec2385d603b6551aa9c4544975644710ce3194c39699430a7a3115b7b0b91684286fa88c598ff48e4b5613ab4b5653bd763effdb4
SSDEEP 96:PqONkOQsjpfwDISp5ih/cIPURHl8h4otop5cmDWBfPGxvw45RxmJm78lFfxQpLkr:SONu6iDCQmiUyfGHq5u88P4ASqt1zU6
TLSH
T14C02F839BC787CBB9EE3AD05B48737175F98116FE6942B84C9E81A2D01D729C2307923
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 d7fc4789671d849fce363cd3554f3f02f886076e3d256d347820bc306e8d8454
MD5 f399217c82788553396125a923bfd62c
SHA1 ed0ed47f92c5bda3e64f19b89983cc3bf26568d2
SHA512 62aad8a6df47b2084835b51af4417b741d98dfa267e0bdda74d74155ed42474ff3915980558de433589f29582bcf4d34dde7894ec0c96c4e6c684901aa43d386
SSDEEP 384:YZcIhsNVckRH4t4p5u8i4t/htgOIwZOy1L9oO:mh5yk6hXsOZJ
TLSH
T19F828D369CB86C7A6CE7A545F58B32035FB88167E3C8AF94C5EC571D01EB298130B913
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 cf97e6c55109b6f2f2c777d58c04771f862a1a96cf8e5a1b3e301973dc5ec5e4
MD5 09b47968068d8d73b8b03c76cedb9886
SHA1 776b8cf4be74288eeb1aae517edc6336a5b40100
SHA512 189e05229e9d9dad1d0e3a3d74773c23d0e6b7977b57e3e325ac5fccfffa387ff453667ceff1ec1522e62b9fb45d898455f843d18bedb7018a363e7b4657fea6
SSDEEP 192:SONA6iDeQmiUyUGIq5u88P4tmeth8uZnq6U6:SONA67yIq5u8i4tZhU6
TLSH
T119120B3AA8687C7B6DE3A854B48736175EA54267E7887F84D5DC161C01EF29C230B913
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

4ffc4f04-8bfa-4257-8492-d52ccfcc273d.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\4ffc4f04-8bfa-4257-8492-d52ccfcc273d.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 52d09abd716fae3f936166a951e50559b4849be5a40bf006f6ea3a1ca83178b4
MD5 f0edb7a96b2b17d6317785f085d801bc
SHA1 0da48dea8080cd3c67e3b12c35eeff8187fa479d
SHA512 1d5db0f05b5d5613cbb3675107bd3f775a16c43a66fe1585e6b0754d51aded781c6982e4b51867f2feb532aa1a32780a406b43efb46db7ec8ef9196bac87cd91
TLSH
T15241275DB6F91148B3B77F5A9FF6A86E88BF79232E0AD59D00110D4F0622A00C871B33
MD5 SHA1 SHA512 TLSH

Submit Download