a4125eb64efcd4e1ca3ecded63d296c0d59e8de4729742ab90f2e0d3de32e46a

Analysis

max time kernel
149s
max time network
137s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
30/09/2026, 18:34

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
gpbc/about.html
Size 45KB
Sample260930-w7tabayeng
SHA256 a4125eb64efcd4e1ca3ecded63d296c0d59e8de4729742ab90f2e0d3de32e46a
MD5 be174185e7a7fe2db3037c41b0127201
SHA1 4bb738dcfd678389c18e9b1349b912b037f35b3c
SHA512 0a559dd9d1d1cabf8312c74ff9d0f583a506a0df279b403ed4d5a16bd578b0a4094b0b00d49b25ca81f5cf9068cda7dbaf3b1c4b6015e8736a3290e86d122ed9
SSDEEP 384:OdnhbTgIQkMESwoJTmxyeQv6ST4+CtewUGfU+h:GnhQsM7pqY0IwpfV
TLSH
T1A7230F2128F8113B018290E56E646B1F6FD2E717DA1F1A1472FC1BD95FD3E8ACE27219
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
2036	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-747854149-4118156852-591593384-1000\{F752BE76-DC90-4AA7-B485-4D97570B805E}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4960	msedge.exe
4960	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
4372	msedge.exe
4372	msedge.exe
4372	msedge.exe
4372	msedge.exe
4372	msedge.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
4372	msedge.exe
4372	msedge.exe
4372	msedge.exe
4372	msedge.exe
4372	msedge.exe
4372	msedge.exe
4372	msedge.exe
4372	msedge.exe
4372	msedge.exe
4372	msedge.exe
4372	msedge.exe
4372	msedge.exe
4372	msedge.exe
4372	msedge.exe
4372	msedge.exe
4372	msedge.exe
4372	msedge.exe
4372	msedge.exe
4372	msedge.exe
4372	msedge.exe
4372	msedge.exe
4372	msedge.exe
4372	msedge.exe
4372	msedge.exe
4372	msedge.exe
4372	msedge.exe
4372	msedge.exe
4372	msedge.exe
4372	msedge.exe
4372	msedge.exe
4372	msedge.exe
4372	msedge.exe
4372	msedge.exe
4372	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
4372	msedge.exe
4372	msedge.exe
4372	msedge.exe
4372	msedge.exe
4372	msedge.exe
4372	msedge.exe
4372	msedge.exe
4372	msedge.exe
4372	msedge.exe
4372	msedge.exe
4372	msedge.exe
4372	msedge.exe
4372	msedge.exe
4372	msedge.exe
4372	msedge.exe
4372	msedge.exe
4372	msedge.exe
4372	msedge.exe
4372	msedge.exe
4372	msedge.exe
4372	msedge.exe
4372	msedge.exe
4372	msedge.exe
4372	msedge.exe
4372	msedge.exe
4372	msedge.exe
4372	msedge.exe
4372	msedge.exe
4372	msedge.exe
4372	msedge.exe
4372	msedge.exe
4372	msedge.exe

Suspicious use of WriteProcessMemory 30 IoCs

description	pid	Process	procid_target
PID 4372 wrote to memory of 4848	4372	msedge.exe	86
PID 4372 wrote to memory of 2036	4372	msedge.exe	87
PID 4372 wrote to memory of 3844	4372	msedge.exe	88
PID 4372 wrote to memory of 3844	4372	msedge.exe	88
PID 4372 wrote to memory of 3844	4372	msedge.exe	88
PID 4372 wrote to memory of 1536	4372	msedge.exe	90
PID 4372 wrote to memory of 1536	4372	msedge.exe	90
PID 4372 wrote to memory of 5080	4372	msedge.exe	91
PID 4372 wrote to memory of 5080	4372	msedge.exe	91
PID 4372 wrote to memory of 4668	4372	msedge.exe	92
PID 4372 wrote to memory of 5080	4372	msedge.exe	91
PID 4372 wrote to memory of 4668	4372	msedge.exe	92
PID 4372 wrote to memory of 4668	4372	msedge.exe	92
PID 4372 wrote to memory of 2516	4372	msedge.exe	93
PID 4372 wrote to memory of 2516	4372	msedge.exe	93
PID 4372 wrote to memory of 2516	4372	msedge.exe	93
PID 4372 wrote to memory of 3276	4372	msedge.exe	94
PID 4372 wrote to memory of 3276	4372	msedge.exe	94
PID 4372 wrote to memory of 3276	4372	msedge.exe	94
PID 4372 wrote to memory of 2204	4372	msedge.exe	97
PID 4372 wrote to memory of 5036	4372	msedge.exe	98
PID 4372 wrote to memory of 2204	4372	msedge.exe	97
PID 4372 wrote to memory of 5036	4372	msedge.exe	98
PID 4372 wrote to memory of 732	4372	msedge.exe	101
PID 4372 wrote to memory of 3404	4372	msedge.exe	114
PID 4372 wrote to memory of 4412	4372	msedge.exe	115
PID 4372 wrote to memory of 2120	4372	msedge.exe	116
PID 4372 wrote to memory of 5048	4372	msedge.exe	119
PID 4372 wrote to memory of 5048	4372	msedge.exe	119
PID 4372 wrote to memory of 4960	4372	msedge.exe	123

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument C:\Users\Admin\AppData\Local\Temp\gpbc\about.html
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4372
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x2f0,0x7ffb68e1c188,0x7ffb68e1c194,0x7ffb68e1c1a0
  2⤵
  PID:4848
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1848,i,2803082337386274822,16300760405984051600,524288 --field-trial-handle=2260,i,2619652722116370002,14947521047855691869,262144 --variations-seed-version --mojo-platform-channel-handle=2300 /prefetch:3
  2⤵
  - System Time Discovery
  PID:2036
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1740,i,5161013668611144516,1909184207548627079,262144 --field-trial-handle=2260,i,2619652722116370002,14947521047855691869,262144 --variations-seed-version --mojo-platform-channel-handle=2256 /prefetch:2
  2⤵
  PID:3844
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2660,i,12768869458631752226,12550275899355764512,524288 --field-trial-handle=2260,i,2619652722116370002,14947521047855691869,262144 --variations-seed-version --mojo-platform-channel-handle=2664 /prefetch:8
  2⤵
  PID:1536
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3440,i,13896893993708398759,13377277430746152400,2097152 --field-trial-handle=2260,i,2619652722116370002,14947521047855691869,262144 --variations-seed-version --mojo-platform-channel-handle=3484 /prefetch:1
  2⤵
  PID:5080
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3448,i,10945686660164949513,15740909729353134109,2097152 --field-trial-handle=2260,i,2619652722116370002,14947521047855691869,262144 --variations-seed-version --mojo-platform-channel-handle=3488 /prefetch:1
  2⤵
  PID:4668
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4212,i,4809612977566186160,5577218554438479461,2097152 --field-trial-handle=2260,i,2619652722116370002,14947521047855691869,262144 --variations-seed-version --mojo-platform-channel-handle=4264 /prefetch:1
  2⤵
  PID:2516
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4244,i,9467429107836959340,17302435691818921806,2097152 --field-trial-handle=2260,i,2619652722116370002,14947521047855691869,262144 --variations-seed-version --mojo-platform-channel-handle=4296 /prefetch:2
  2⤵
  PID:3276
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3640,i,10542650371614504488,14227067463368974434,524288 --field-trial-handle=2260,i,2619652722116370002,14947521047855691869,262144 --variations-seed-version --mojo-platform-channel-handle=5064 /prefetch:8
  2⤵
  PID:2204
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3604,i,7027249619550840948,9330698101673145326,524288 --field-trial-handle=2260,i,2619652722116370002,14947521047855691869,262144 --variations-seed-version --mojo-platform-channel-handle=5160 /prefetch:8
  2⤵
  PID:5036
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5912,i,3955807572404307710,3996063467778173107,524288 --field-trial-handle=2260,i,2619652722116370002,14947521047855691869,262144 --variations-seed-version --mojo-platform-channel-handle=5816 /prefetch:8
  2⤵
  PID:628
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5912,i,3955807572404307710,3996063467778173107,524288 --field-trial-handle=2260,i,2619652722116370002,14947521047855691869,262144 --variations-seed-version --mojo-platform-channel-handle=5816 /prefetch:8
  2⤵
  PID:732
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4432,i,15751433509425950456,11246907975517141167,524288 --field-trial-handle=2260,i,2619652722116370002,14947521047855691869,262144 --variations-seed-version --mojo-platform-channel-handle=4332 /prefetch:8
  2⤵
  PID:3404
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5008,i,3306693798896515062,16170058485323503102,524288 --field-trial-handle=2260,i,2619652722116370002,14947521047855691869,262144 --variations-seed-version --mojo-platform-channel-handle=4244 /prefetch:8
  2⤵
  PID:4412
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4340,i,5296791781279716597,5715044480849118352,524288 --field-trial-handle=2260,i,2619652722116370002,14947521047855691869,262144 --variations-seed-version --mojo-platform-channel-handle=4468 /prefetch:8
  2⤵
  PID:2120
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5432,i,13379624602845047307,6491169350072722784,524288 --field-trial-handle=2260,i,2619652722116370002,14947521047855691869,262144 --variations-seed-version --mojo-platform-channel-handle=3060 /prefetch:8
  2⤵
  PID:5048
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=3556,i,5678802557319812474,7444897655777239301,262144 --field-trial-handle=2260,i,2619652722116370002,14947521047855691869,262144 --variations-seed-version --mojo-platform-channel-handle=6052 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4960

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:1884

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

0e95bc7b-588a-4dbf-8fb9-a1662f089854.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\0e95bc7b-588a-4dbf-8fb9-a1662f089854.tmp
Size 18KB
SHA256 e49330e37c8b5af2ffd57b09d8be56f5081cda7180ca0cc223881089ce2aa4e0
MD5 b4b76b997996588336467c1f4c4c67c9
SHA1 74e826358ab560f7d33d747ccbb310b68f756604
SHA512 bcaa62c52f151fe686fed00557df157ab85a94c31c52b04b880913a7d7e8f0629f92b7365914ca880551eaeb0f9b74f7cd0d8c1992e2c53a6f21230bc8923ab8
SSDEEP 384:SZcIhsNgUC+5pA/uBGYX5EfMgxIztgOIwZOywLwo1:ghwkQGYufMgKzXs3MW
TLSH
T191827D329CB86CBA2CE7D195F18726034FB89127E7C5AF54D5EE6B1C01DA688130BD27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 a62a1faeaaa56a5f5375b4d4921e6b263c0bc10a5ecc1f991894c66c32a88aef
MD5 64fcd85513a139bcf5844ab49aea8206
SHA1 3c834eccb77da48c4abac17c440971305fd9b653
SHA512 cd1b39ff43d56158fbb01c5408a5bf247d5bd82279b205a914ab4cdccfece77a5399e430bb26db6f7d10e70dc3503c3bf37c5de59e23cb8f62d6337066c4114f
TLSH
T15DD02232EBF00E82C00B0032082282880F08C03C08003222A23C20AE3A80CEC2E23000
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\temp-index
Size 3KB
SHA256 be775f10ebc8b42c5d1ad66ac18fdbd19f86c819b770778a8ed2188c37fd5ec3
MD5 11f95cc1c18fe1df5408a8a02f8df62d
SHA1 edd626b38c655d78d473f558bcb474ef5c784155
SHA512 8b9805413526de2c1626662911b639481e6f1a47789fdfccbf2af75807fd59dddbbe72c6b11ca6d932de9bc0f7f9c01c28a28ce2fd4b769a8630e3deff8b95ab
TLSH
T1AB615EC41698609BFBA8B17186D6F18B35319CB29583FE9E00F6E76D4CC6B97C30428C
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 1KB
SHA256 a08865407711df1c29bb160c59f97da31a8fb2a9f1192f008ead09e4775627f8
MD5 799bef5d57ab8406e1029e20aab6e161
SHA1 0186ef1671850f2ecc406f8df771ae2150ce9010
SHA512 c7be37210978fbaff8e39ec3abc3d593f63694a035804372ff7ef15a5931ad3528abfff6cfa189170738e9a13796dff9e21ce03209a7fc34718c9005ed144960
TLSH
T1DD318DB7C3D4866E8D1156F05B24AE1BCE1D051642283C5AC9E4EF5B93E3475D20259F
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 9KB
SHA256 7aabd4362970053aed113b6e4efc5c99449b889b6495eeaa919c9dbe61410d56
MD5 9107d3ecf0a3bd931d31a821e0083394
SHA1 d2425752713cc1a37eddbeb01131f41571d076bc
SHA512 5febd326cf4a15fe4667e1812e2e9cc94c53c713bd10e08f0073b8c97e8fbce8d7f7921e8e92af09cbf00b1fc538f77eadd7b4a65e9f0a87dfa8ae9a1b4a0d38
SSDEEP 192:sxZSRjWG/frsM/IdpdYHW6+WNGYgUb+jIgrJ:sxZSsG/frsMwGHbGQQ9
TLSH
T17B22A7116E38A97B8CC7D20DBB65BF13D6F95032A5D11E48AAFC861C05E6ADE1207C0F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 10KB
SHA256 f5bc5d4c99f99895e174f05390b97f08242dd1333449ddbc096080f33b479d92
MD5 23d6f55f5094c3f1c34708384f156329
SHA1 487d1613a3eef3e21859713ffbff0e64c3f78096
SHA512 0446887ef1c749e3c9066fb90199670cef154ccda376128cdc15ee58a310557921148b4327e6e8ab9d41855cb487f7f1cbfd79b9f80fdf8ad3d3be00480c9b43
SSDEEP 192:sxZSRjWG/frs6/IdpdYHW6+WNGYgrCb+jIg5+J:sxZSsG/frs6wGHbGqQE
TLSH
T1E922A5516E38697B8CC7D20DBB55BF13E6F95032A1D11E48A6FC861C05E6ACE2207C0F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 10KB
SHA256 9f1119ba551ff683b3a292851558a6a7e23e626b6d8f2deb39894a3f5b3be71e
MD5 ffb4bc4711a8740cd9fc6c5eb37df204
SHA1 bf7dc8ff36f102208202341d069b14a1eef45cd8
SHA512 d5575a3465ae3d2534628b36f6368a8bc07b0fb0d528ea5cf56310240525a5482b13aabb51908c92398b5d531ecdced6076445e8ac908ed16724d91412d918d5
SSDEEP 192:sxZSRjWG/frs6/IdpHYHW6+WNGYgbBb+jIg5+J:sxZSsG/frs6w4HbG3QE
TLSH
T14122A5516E38697B8CC7D20DBB55BF13E2F95032A1D11E48A6FC861C05E6ACE2207C4F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 10KB
SHA256 cd6383b8e44da1d2b468f449a75842b7c1d43ca078ed2f939502a70c4c2fff1e
MD5 859366b9b70294461708949b53f06917
SHA1 f5527734287c3611d8f846190a5d05d25519fa41
SHA512 f8dac85e5df8dfadb1fa076e9eedf0e9a10b638e75185ac9b476c4e46cbdf7567afb7701ff47f78b454a7b7769d28e701c474916f7c0c17c37d3038f0c6244fa
SSDEEP 192:sxZSRjWG/frsc/IdpdYHW6+WNGYgUb+jIg5MJ:sxZSsG/frscwGHbGQQG
TLSH
T18F22B7116E38A97B8CC7D20DBB55BF13D6F91032A5D11E48A6FC861C05E6ACE2207C4F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 27KB
SHA256 fade77f53f632295eb93ca524afa434934bb6b4ae8978f0e943a2a6e6a197b69
MD5 7092df64e58815fb3b5b46dc22cf44c7
SHA1 f7fd2e624ef34a09ac69dcdaae7143b6620f8381
SHA512 c4e90626019d77b5352d7d581ba0c33ef57c6fbedb0f598cfd5038a57a2c6aea7afb9e10523cc533b7aab91d9c27da968100d4bc05e97371c15615454b56a370
SSDEEP 768:u/ichfPWvPZpl8F1+UoAYDCx9Tuqh0VfUC9xbog/OVu+LlEKXzxrowYx:u/ichfPWvPZplu1jan+LKgzK5x
TLSH
T1C7C2EA3B640CCB7E4FC01A9DDD5A6F9A7E9802C7A6588D4047FA984C02C77EE91264DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 f5b1b60370f6a39f81b59392416d712ea59e8f62117c48426eb75382f27acbc5
MD5 905e746d368e6ed1cbc78b47e7c1a509
SHA1 2f4e181ec7a3aa961a8f505644df509a473123ed
SHA512 50c105cc9590efd4a75408371a8da42ae8298979de9e6adb5e2f94aeb2cefa38403462a958defc4d479e6b051c7142f9f69648568d6b6e8872a0493a3ae2ffe8
SSDEEP 48:K0c5cIcVcpczc3cLckbc3cScPIScBckK9cB1crckxcJc0YcyczcJc5yLc0cDcCc2:KwvmKEsiyC8KXKAQwKVyqNy3Gio0gkz
TLSH
T19B91014131FA12917CBE285980A9DB5E62E13172311CEE7BBBBC10714F6AE441CFE8D9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig~RFe59b905.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig~RFe59b905.TMP
Size 3KB
SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
MD5 904e6e94a1d46374c8630cfd86cc729f
SHA1 e1d9c3f7813878acc6510d48d95b2bf48b2e1a0d
SHA512 081e2a26252860ff8d8f7a9d0378ae56f0cc50574d13d2a121afdf74284963747ef874a4d73b1df7774cd8570972f4f513eefe0a0325fd088556d5b1ba946712
TLSH
T1DB815C4FCC0CBE77ABAB6A719A35D6B2F79131EA94518A977F8C444EE3050ED0242E50
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 835affb9c8d9e4dd4e6ec6a7cc9c294823769328b08293a40aa2476fdbb6877d
MD5 cc5639ce71b3a18015961f1d98f76bb2
SHA1 9bfbed2fae085a8163739ad63c56b83214225bcc
SHA512 720feb1862c869756fd3cf484ee304a51c94f41dfbe95f7bb46255703e0c4f87aade3b7438eaaba71d85a1a39c45bd5ebbc896745ecc8259bf02f63dae7f9b36
SSDEEP 192:LJONI6DphmqQmiUyUCq8wGYX59ezWC+m4Mkk7CZU6:lONI619+RwGYX5EfMqaU6
TLSH
T1D802FA35ECB87CBB8DE3AE55B58B2A175FD8212FAA952F44C6D81A1C01C764C2307837
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 55817cad601e3301262f9493509875549645baba0f2b83a838c4d042a2253c42
MD5 b69b44999dc5811fd26374cbb67ed524
SHA1 9ba81b2d4a604e0c6aba3c03fff5402c8121ddd8
SHA512 cb9210c68158b37b8997978629b1a9582a69a4c65f91899451fb434792be9616027532bf2c75e7164a6b20008e9ed38201954a0ffc25903421dc37e980e23273
SSDEEP 384:aZcIhsNgUz+5pA/uBGYX5EfMgxIztgOIwZOywLwo1:YhrkQGYufMgKzXs3MW
TLSH
T1E7828D328CB86CBA1CE7D194F18726035FB8912BE7C5AF5495EE6B1D00DA688130BD27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 21KB
SHA256 ac64808d25a3ceaafa523f379a9f7d06c03f6d26f0d6047a148a23ccb27bb1f6
MD5 aab2a21b6d92c56bd78c23be33fe2107
SHA1 7f5968f9f6f253b18226fdb80117f87cd0ca36e7
SHA512 e0b86a251556593b94bb755714541403adf3fa3b722de57053518afe02a66810f18f887f6220a26650632ae0c76e46b78bb0929c014a8d7afc7664054469aa95
SSDEEP 384:riFiZcICzsNB8TUNTUlIlz+5pA/uBGYX5EfMgx8ztgOIwZOywLwo1:GFQKYwg4kQGYufMgyzXs3MW
TLSH
T106A26C338CB898BF6DFB9A84F58A26038FB45167D6C5EB90E6DD5A1C00D71C8130BD16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 ce476512421bda47f8fdba681f48f639dcd57b4678aa5cf24efc9a99a4776db0
MD5 3621c4e61e67c25431d479e743f284b7
SHA1 8f82197ab2509e6181601fb4b8f22261b171fb80
SHA512 e46d52697cf59ecbc0c4c0f328ed1d6969d92ff63e15219c0074f25b4e69767dacfd8e5a99089e4a6dad8d2d64e52d83413248eab849bcbc5cc848e0777edcb9
SSDEEP 192:LJONi6Dph6qQmiUyPCCwGYX59ezWC+m4gx+eLkII7q5WU6:lONi61dhCwGYX5EfMgxSzU6
TLSH
T1D2121C3598B8BC7B5DD3A490F48B35035FA4622BEB857F50D5ED2A1C01EF59C130B926
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

945f952c-b8d1-40e1-a94a-2a5fa5140574.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\945f952c-b8d1-40e1-a94a-2a5fa5140574.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 7dfcb55b3965ccadbfcff3fee466566d234c7152eb2f4e9930dd565fd78dcec4
MD5 3d6cef9dce1998727ff8aa5649298ccb
SHA1 acea822073d70969a8c8e0469db0e3c4060b2c4d
SHA512 6327761d6a7746c298130d8df94d34bfe1e937a74907ed2b7f6190784699f76c1177dd17b023dbc1a0f2d3a14b70e0aaf37c04000116ab4573ca0c4c153db259
TLSH
T1DA41FB58A7F90148B3B76E5AABF6686D447AB9772E0AD49D00110D4F0A76A00CD71737
MD5 SHA1 SHA512 TLSH

Submit Download