hxxps://amicogroupuae[.]sharepoint[.]com/sites/NewEmployeePreOnboarding/SitePages/Welcome[.]aspx

Analysis

user interaction
yes
max time kernel
148s
max time network
139s
platform
windows10-ltsc_2021_x64
resource
win10ltsc2021-20260911-en
resource tags

arch:x64arch:x86image:win10ltsc2021-20260911-enlocale:en-usos:windows10-ltsc_2021-x64systemwindows
submitted
01/10/2026, 06:32

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://amicogroupuae.sharepoint.com/sites/NewEmployeePreOnboarding/SitePages/Welcome.aspx
Sample261001-hasqmattev

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4528	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-686476835-2493921010-524562731-1000\{7DD36175-813E-451D-9F25-BD6AE959ED38}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2068	msedge.exe
2068	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
2736	msedge.exe
2736	msedge.exe
2736	msedge.exe
2736	msedge.exe
2736	msedge.exe
2736	msedge.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
2736	msedge.exe
2736	msedge.exe
2736	msedge.exe
2736	msedge.exe
2736	msedge.exe
2736	msedge.exe
2736	msedge.exe
2736	msedge.exe
2736	msedge.exe
2736	msedge.exe
2736	msedge.exe
2736	msedge.exe
2736	msedge.exe
2736	msedge.exe
2736	msedge.exe
2736	msedge.exe
2736	msedge.exe
2736	msedge.exe
2736	msedge.exe
2736	msedge.exe
2736	msedge.exe
2736	msedge.exe
2736	msedge.exe
2736	msedge.exe
2736	msedge.exe
2736	msedge.exe
2736	msedge.exe
2736	msedge.exe
2736	msedge.exe
2736	msedge.exe
2736	msedge.exe
2736	msedge.exe
2736	msedge.exe
2736	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
2736	msedge.exe
2736	msedge.exe
2736	msedge.exe
2736	msedge.exe
2736	msedge.exe
2736	msedge.exe
2736	msedge.exe
2736	msedge.exe
2736	msedge.exe
2736	msedge.exe
2736	msedge.exe
2736	msedge.exe
2736	msedge.exe
2736	msedge.exe
2736	msedge.exe
2736	msedge.exe
2736	msedge.exe
2736	msedge.exe
2736	msedge.exe
2736	msedge.exe
2736	msedge.exe
2736	msedge.exe
2736	msedge.exe
2736	msedge.exe
2736	msedge.exe
2736	msedge.exe
2736	msedge.exe
2736	msedge.exe
2736	msedge.exe
2736	msedge.exe
2736	msedge.exe
2736	msedge.exe

Suspicious use of WriteProcessMemory 33 IoCs

description	pid	Process	procid_target
PID 2736 wrote to memory of 3504	2736	msedge.exe	86
PID 2736 wrote to memory of 4528	2736	msedge.exe	87
PID 2736 wrote to memory of 4928	2736	msedge.exe	88
PID 2736 wrote to memory of 4928	2736	msedge.exe	88
PID 2736 wrote to memory of 4928	2736	msedge.exe	88
PID 2736 wrote to memory of 4856	2736	msedge.exe	89
PID 2736 wrote to memory of 4856	2736	msedge.exe	89
PID 2736 wrote to memory of 2344	2736	msedge.exe	90
PID 2736 wrote to memory of 2272	2736	msedge.exe	91
PID 2736 wrote to memory of 2344	2736	msedge.exe	90
PID 2736 wrote to memory of 2344	2736	msedge.exe	90
PID 2736 wrote to memory of 2272	2736	msedge.exe	91
PID 2736 wrote to memory of 2272	2736	msedge.exe	91
PID 2736 wrote to memory of 908	2736	msedge.exe	93
PID 2736 wrote to memory of 2316	2736	msedge.exe	94
PID 2736 wrote to memory of 908	2736	msedge.exe	93
PID 2736 wrote to memory of 908	2736	msedge.exe	93
PID 2736 wrote to memory of 2316	2736	msedge.exe	94
PID 2736 wrote to memory of 2316	2736	msedge.exe	94
PID 2736 wrote to memory of 1268	2736	msedge.exe	98
PID 2736 wrote to memory of 1268	2736	msedge.exe	98
PID 2736 wrote to memory of 1268	2736	msedge.exe	98
PID 2736 wrote to memory of 4084	2736	msedge.exe	99
PID 2736 wrote to memory of 4696	2736	msedge.exe	100
PID 2736 wrote to memory of 4084	2736	msedge.exe	99
PID 2736 wrote to memory of 4696	2736	msedge.exe	100
PID 2736 wrote to memory of 1536	2736	msedge.exe	105
PID 2736 wrote to memory of 4692	2736	msedge.exe	112
PID 2736 wrote to memory of 4164	2736	msedge.exe	113
PID 2736 wrote to memory of 3320	2736	msedge.exe	114
PID 2736 wrote to memory of 2220	2736	msedge.exe	115
PID 2736 wrote to memory of 2220	2736	msedge.exe	115
PID 2736 wrote to memory of 2068	2736	msedge.exe	116

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://amicogroupuae.sharepoint.com/sites/NewEmployeePreOnboarding/SitePages/Welcome.aspx
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2736
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x260,0x264,0x268,0x25c,0x308,0x7ffa143cc188,0x7ffa143cc194,0x7ffa143cc1a0
  2⤵
  PID:3504
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1836,i,1452720811889407947,5146320567730563502,524288 --field-trial-handle=2208,i,5293666504608823758,18218359906335564064,262144 --variations-seed-version --mojo-platform-channel-handle=2248 /prefetch:3
  2⤵
  - System Time Discovery
  PID:4528
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1652,i,550935665879465325,247636665233349023,262144 --field-trial-handle=2208,i,5293666504608823758,18218359906335564064,262144 --variations-seed-version --mojo-platform-channel-handle=2204 /prefetch:2
  2⤵
  PID:4928
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2548,i,3437946942582211323,17604040909169995400,524288 --field-trial-handle=2208,i,5293666504608823758,18218359906335564064,262144 --variations-seed-version --mojo-platform-channel-handle=2556 /prefetch:8
  2⤵
  PID:4856
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3424,i,14435920081666797972,3158431618509766776,2097152 --field-trial-handle=2208,i,5293666504608823758,18218359906335564064,262144 --variations-seed-version --mojo-platform-channel-handle=3436 /prefetch:1
  2⤵
  PID:2344
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3432,i,7811833191544439494,8118334608460264231,2097152 --field-trial-handle=2208,i,5293666504608823758,18218359906335564064,262144 --variations-seed-version --mojo-platform-channel-handle=3516 /prefetch:1
  2⤵
  PID:2272
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4200,i,8474054412901426897,5155337535422169670,2097152 --field-trial-handle=2208,i,5293666504608823758,18218359906335564064,262144 --variations-seed-version --mojo-platform-channel-handle=4240 /prefetch:1
  2⤵
  PID:908
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4224,i,2991446559345242083,10702383491062366799,2097152 --field-trial-handle=2208,i,5293666504608823758,18218359906335564064,262144 --variations-seed-version --mojo-platform-channel-handle=4268 /prefetch:2
  2⤵
  PID:2316
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=5172,i,9572234213357653393,11544292738140663300,2097152 --field-trial-handle=2208,i,5293666504608823758,18218359906335564064,262144 --variations-seed-version --mojo-platform-channel-handle=5188 /prefetch:1
  2⤵
  PID:1268
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3380,i,3146712306524459162,3406795240826552324,524288 --field-trial-handle=2208,i,5293666504608823758,18218359906335564064,262144 --variations-seed-version --mojo-platform-channel-handle=5400 /prefetch:8
  2⤵
  PID:4084
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3640,i,5834727061738191530,5976874688455255657,524288 --field-trial-handle=2208,i,5293666504608823758,18218359906335564064,262144 --variations-seed-version --mojo-platform-channel-handle=5020 /prefetch:8
  2⤵
  PID:4696
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5992,i,7622821933844966565,7162388423865477915,524288 --field-trial-handle=2208,i,5293666504608823758,18218359906335564064,262144 --variations-seed-version --mojo-platform-channel-handle=6008 /prefetch:8
  2⤵
  PID:4312
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5992,i,7622821933844966565,7162388423865477915,524288 --field-trial-handle=2208,i,5293666504608823758,18218359906335564064,262144 --variations-seed-version --mojo-platform-channel-handle=6008 /prefetch:8
  2⤵
  PID:1536
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5848,i,2338999252329269391,5716757546596224915,524288 --field-trial-handle=2208,i,5293666504608823758,18218359906335564064,262144 --variations-seed-version --mojo-platform-channel-handle=6392 /prefetch:8
  2⤵
  PID:4692
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6400,i,6018346119605348479,12047892224241300517,524288 --field-trial-handle=2208,i,5293666504608823758,18218359906335564064,262144 --variations-seed-version --mojo-platform-channel-handle=4356 /prefetch:8
  2⤵
  PID:4164
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6408,i,13044843737978808284,9813017734193331266,524288 --field-trial-handle=2208,i,5293666504608823758,18218359906335564064,262144 --variations-seed-version --mojo-platform-channel-handle=4500 /prefetch:8
  2⤵
  PID:3320
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2164,i,15224773077429608129,8106342306961982295,524288 --field-trial-handle=2208,i,5293666504608823758,18218359906335564064,262144 --variations-seed-version --mojo-platform-channel-handle=3052 /prefetch:8
  2⤵
  PID:2220
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.4355 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=3708,i,3603933153923921696,17418456228687187929,262144 --field-trial-handle=2208,i,5293666504608823758,18218359906335564064,262144 --variations-seed-version --mojo-platform-channel-handle=2984 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2068

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:1648

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 3a6eb5861393f83eb8b8016687c085da7ebeddb12e0086793cdaa97de2bf4d89
MD5 8f87b0f71fdb0e4babafb4d64f50918b
SHA1 ef9954a611e31dc1fc21cf5cdda9b032620389c3
SHA512 80b6b9a9ac529a7fa05c075fcb3af3a9438a9aa4a8462d2e9843ebf64816a6abb19f112e682567ce8c0abf07c734928796f290fd602cffbf3df31d92dc5eb530
TLSH
T1F5D02220B3038C80C8CCA0BC0F208B002E0EEC080022E2038AF000C0ACC2FF080C20E0
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 2cbdecd303a7e9ea0ce94baa450d3b047a1edf586300e4947c57d88291910733
MD5 2d8c10d42a8ac6e8eb6e6d36c53591ab
SHA1 9cbb2af787af4f0174815753d1fb7231fae30ec8
SHA512 0365b2fb9fb7c3ddb4d312af474044b0160cbad1e022fa186751cfaa355015874edf8f80c8abdabc28d5fad2b69acf8c17686c8382dcb23c267475468464b67a
TLSH
T180D0222033038C80CCCCA0BC0F208B002E0EEC080022E3038AF000C08CC3FF080C20E0
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 ca236f29fc6a4eddbca87fac370c59649f04cebee286b70c2f21ed8b69b8010f
MD5 f50a9b66f4c7f753fc485052a334b50b
SHA1 7f7ab9ea3d56c1d4b1df3e1bd815419eff103831
SHA512 4a3536814cd338884a0e9be058ba83f3a694f68ed50ae419257885179de125e9d7efce9d59b882109f1726ebf21b22116d2576f5cb699108227ca30870385c22
TLSH
T1F971FBB46A529C8DC7B469708DC510FBBD3B958CBDE3EF1E08E4E87497723A4B198600
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe58d666.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe58d666.TMP
Size 3KB
SHA256 366be18b7960f8f2c5f3d925da19ab418a36fa96ad69f62751fe11ecaa3b1712
MD5 00b11dc5936df75e669a1f4270a1a554
SHA1 9f73f6ec487b0067db043762347faa311f035211
SHA512 87b23ad100409d414e65b6a1440e9982c668fb682d4c42854aec70337fc2c2591ac12cb9da16fb2c695c79f25fac58abdd9d48ae2ac3d8f695eda8de2d7f1d45
TLSH
T1E261D8B456529C8DC3B869708ED410FBBD3B998CBDE3DF5E18E8E97457323A47188204
MD5 SHA1 SHA512 TLSH

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 ece5d2ff47bcd825afe403f7bb788fb757123de301a1ff922a4ff0f0c265f5fe
MD5 ae83b4bc5e0d826502dfff56cc55294d
SHA1 40022f615e8a8b5f5e53d2119c517964f46ea65d
SHA512 fcedd46c2f368b89117ddddce78dafaa34157ff840c022810fa5f0661503de744544934f978d7fe0a481d5b54ac242e5ea31e3b2bd0db48b99f5425bd3fc5c1a
TLSH
T1F341CEF787E1416ECA1152F4AA14AE2BCF6C0510436C785AC5D8EE27E3F34B1E11268B
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 9KB
SHA256 d72a4021cc24e9046901f91daf5949b8aa0e9c335f38acd89115ec8a7bdf9c8a
MD5 fcb0b2f817fb99eb94edf7b575abaa34
SHA1 7cb6b15358934fdcad4463076ae93c6a5b516b99
SHA512 15b7d42161b68ab9c67ab9012d8e9f55b5639fb2f6f5b0deb32195c0d31b47d77561f22f87f353f3634abd0a8d9a6ef5785c0ae2e0b15032accc212082535f9e
SSDEEP 192:sxZhRNW0/fGsP+sIdpL5HW6+WNfda/YrnVLIgrJ:sxZh+0/fGsP+11HbY/S9
TLSH
T1602297526E28A97B8CC7D20DBA25BF53E6F9503295D11E48EAFC952C04E76DD220780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 10KB
SHA256 faee0f3c29ce0c72bc9148b4cfe7dba1a49730d339f4a9b28bf647eb61cabd78
MD5 059fd88a8ee6e5833ae896295fee0806
SHA1 5f65661fa0e592659a234d14f0bde18fd4145d29
SHA512 bbe00f37dbd069a2b867b28961eac8f62ca2b305bc85a53f15563ff57f66b5a005690a07b6e72f0d35fe0a787322a77cc68dad6a8ab2589c3f28464b38842692
SSDEEP 192:sxZhRNW0/fGsy+sIdpR5HW6+WNfFtXYrhVLIg5lJ:sxZh+0/fGsy+1XHbjXul
TLSH
T19322C8526E28697B8CC7E20DBB25BF53E2F9503295901E48AAFCD62C04E77CD220740F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 10KB
SHA256 e9ef761ec6fc144b363acdd96d845df75a3b2131060dd1bab488852352e21ed1
MD5 43ff10d3f325ef8a0a17dddad7dcd712
SHA1 12ff9a2a742bc78e91ab3183fb8c6187d5667815
SHA512 6483a5db06cc3c8498cf932ef2d3e8986ddae298ee1910d54a11264ec36e6a6dc3e9141320ae6320dc540e6095b7211a42b4d2106d3fad06321675d3a7588b14
SSDEEP 192:sxZhRNW0/fGsy+sIdpL5HW6+WNfda/YriVLIg5lJ:sxZh+0/fGsy+11HbY/hl
TLSH
T1DB22B8526E28A97B8CC7E20DBB25BF53E2F9503291911E48E6FC962C05E77CD220740B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 9KB
SHA256 9528526131d9fc651338cc271b1d77b3a2cf891e8ac7c611ec58eb6f62868ff2
MD5 9cd5cddb07288b77b960cf459e1c1759
SHA1 c84fd724041f2a103570fb1e1e5398cd18fcc8fd
SHA512 1db45a5457c1c3834169ad49fc5f728a7882b46bf87f6543412a099f11a7de001e7e0786225d54fe78ad65273c842327d7310072a2a0738f04e33f985f421c93
SSDEEP 192:sxZhRNW0/fGsR+sIdpL5HW6+WNfda/YrnVLIg5XJ:sxZh+0/fGsR+11HbY/Sz
TLSH
T11522A6526E38A97B8CC7D20DBB65BF53E2F9503291D11E48EAFC952C04E76DD220780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 27KB
SHA256 ca08a09cba58e1b674f70bd433367793b64a9b435d59dff66fc3657a655d8c0b
MD5 70bfe37f66d03d9536e87be20945145c
SHA1 160d3b48ecd886fcc61a5e2dda691d2046f8e6de
SHA512 a343ae44937ba72558d32c0d440336230204c501011b6214963dda265994c4cbcf87bed43752c63f0fdb6b5f5b28be11f32f0e53e24e5da56c9cc7894cb2e47b
SSDEEP 768:lMqqHHlWvdD/T8F1+UoAYDCx9Tuqh0VfUC9xbog/OVU4LliA1n+roQHq1cU:lMqqHHlWvdD/Tu1jaF4LYsnVQI
TLSH
T10BC2FA3B244CCA7E4FC01A9DDD6A6F973EA802C7A6648D4047F9954C02C77EE51274DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

bd6f9003-d3f2-4d6b-8410-67619cd38217.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\bd6f9003-d3f2-4d6b-8410-67619cd38217.tmp
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 26KB
SHA256 92039ef17880114a32e580ada10bd1dd226e49610d5e1e2f70d72b96b94d394b
MD5 680dbf759c5277c6ac043d4c33825282
SHA1 b3277043d22146969497704986b522e2f6bbe3f2
SHA512 8e055579c57c9b0538b03966d3d833e53697922ca543cd69286c9363f58fdaacb26bc6450fbf30da8eab4c8fad71111eedb075e19d33a612b78a46fa3dc712d7
SSDEEP 384:kiFiZcIbzsNR8TUNTUlIlkVT+Jw4VSS0hZEEOx2xcmaX4rVZh6DKhHxoi:/FQPowgS+JVz08EvpC4rfYGHx9
TLSH
T1DBC23BF348D7897AE9AE5743A77E2E034EBCD053B585AA40B3985A1CCC961BFD306811
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 cd692ca69eac2a05431a44cea5e8f6f4fc02ebf7d0d9015fee07ebd5b4a35449
MD5 281b700c42701055daad2a3e57c3a168
SHA1 95f334f536df14dc9ca16d897a6a3e271462e49e
SHA512 866dfddde3a728697d2408fc8ae8eaadeb640ee3cf14272391f8ce77707676387deb2bcd40e34af6fca14c8eefceddd1450afb5aec7311bb105532dfd1f08948
SSDEEP 192:ZONX6xGuQmiUylI1D0hZ/1OECjzoM2oRYcRicE4U6:ZONX6UqV1D0hZEEOx2xcVRU6
TLSH
T16802F835AC686C7B9EF2AE05B5872B174FD4212BA5956F84D6E82F1C00CB69C134A837
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 7deb051fc5623aac48ee9ed5753ec05ad38fef44d5db22cda12309562dda9470
MD5 b5e7f98cbfb9f5118694ed11ae662568
SHA1 83596041e7d50f1127844f06a88c46f8d361fd12
SHA512 65f16dfa82973128deed7cb61e220a1d3c588f6155d0beed732af5e56e9ac6d9ea3ffcfdfeee40d38807bf91e7010e3235837277d1921a6f560da763fa1a4fbc
SSDEEP 384:/ZcIhsNvkVT+Jw4TSS0hZEEOx2xcmaXSrVZh6DKhHxoi:Xhp+JTz08EvpCSrfYGHx9
TLSH
T159827D7298789D7A6DF6A241F48736034FF490179389AF80D1EC6B2D01DA5A8131BD26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 f8c5510cc13e9eddb177b5d2e02d4fb5a246a03bc95b833fadc81af4fdfeb7ba
MD5 ab074d666d64569890b9edef23381de3
SHA1 e4dc0190b591f3e2035b9dbe79abb89475549058
SHA512 7c016c4da764a54061a8e0ef89b58d3c9526154564d946e17ad0ba9f87810e82250c38ac48b73858056c2992fed4ee876a4847d57122f42b10f8b208b0d5469c
SSDEEP 384:UZcIhsNvk0T+Jw4TSS0hZEEOx2xcmaXSrVZh6DKhHxoi:ShI+JTz08EvpCSrfYGHx9
TLSH
T19F827C7398789D7A6DF6A241F4872A034FF890179389AF80D5EC6B2D01DE5A8131BD26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 e3de2dcf7230007d750e1bcebab1121732613eb41a25c0658a0071027327c999
MD5 eef2aa86cd2647386e17244c57103165
SHA1 86de87002cd7c2f2a6f3904bb981379eef5010e8
SHA512 ab153fe4046006bee4bc75b5abd06a34a790e151af3774b5528d9672b51c32c6b94fdd1964a68cdaf3228efc1be91fd6b15e80cb148a4e15326907162a910d16
SSDEEP 192:ZONi6xGxQmiUymIOD0hZ/1OECjzoM2oRYcmaXMdz23lqCU6:ZONi6UPsOD0hZEEOx2xcmaX5rU6
TLSH
T19E12FA32A868AC7B5DE2B644B08735434EE45117EB89BF90D6EC2F2C01DF5AC135ED26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\metadata.json
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 90adccb0e1f026b887510165550df4b37129d28fbc726e8549fdcff3b16fa2ce
MD5 01a3c5ccb4d330cb1f890a7764cd8d6e
SHA1 c94881442f7b60cf7a81f01dc8433fe003f63770
SHA512 159dbeb7543ce019e1467a862f86ba2a8184f6fe810e1b3ed4c2019c978ec1ac7900afeee70d771624e58efce90747bad825f2c7a953299e940f6d4e94568db5
TLSH
T1F141185CBAEE1108B3B37E56ABF6686E447BB9332F16D45D10110E4F0623B41C9A2B37
MD5 SHA1 SHA512 TLSH

Submit Download