hxxps://oneclient[.]sfx[.]ms/PreSignInSettings/Enterprise/2023-01-26-00-30-26/PreSignInSettingsConfig[.]json

Analysis

user interaction
yes
max time kernel
149s
max time network
138s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
30/10/2026, 04:48

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://oneclient.sfx.ms/PreSignInSettings/Enterprise/2023-01-26-00-30-26/PreSignInSettingsConfig.json
Sample261030-ffdgsadc49

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
3712	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-240542094-4193773837-3211495583-1000\{A8A117BE-DFE3-4E13-BBD6-22E9B762695E}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1896	msedge.exe
1896	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
3536	msedge.exe
3536	msedge.exe
3536	msedge.exe
3536	msedge.exe
3536	msedge.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
3536	msedge.exe
3536	msedge.exe
3536	msedge.exe
3536	msedge.exe
3536	msedge.exe
3536	msedge.exe
3536	msedge.exe
3536	msedge.exe
3536	msedge.exe
3536	msedge.exe
3536	msedge.exe
3536	msedge.exe
3536	msedge.exe
3536	msedge.exe
3536	msedge.exe
3536	msedge.exe
3536	msedge.exe
3536	msedge.exe
3536	msedge.exe
3536	msedge.exe
3536	msedge.exe
3536	msedge.exe
3536	msedge.exe
3536	msedge.exe
3536	msedge.exe
3536	msedge.exe
3536	msedge.exe
3536	msedge.exe
3536	msedge.exe
3536	msedge.exe
3536	msedge.exe
3536	msedge.exe
3536	msedge.exe
3536	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
3536	msedge.exe
3536	msedge.exe
3536	msedge.exe
3536	msedge.exe
3536	msedge.exe
3536	msedge.exe
3536	msedge.exe
3536	msedge.exe
3536	msedge.exe
3536	msedge.exe
3536	msedge.exe
3536	msedge.exe
3536	msedge.exe
3536	msedge.exe
3536	msedge.exe
3536	msedge.exe
3536	msedge.exe
3536	msedge.exe
3536	msedge.exe
3536	msedge.exe
3536	msedge.exe
3536	msedge.exe
3536	msedge.exe
3536	msedge.exe
3536	msedge.exe
3536	msedge.exe
3536	msedge.exe
3536	msedge.exe
3536	msedge.exe
3536	msedge.exe
3536	msedge.exe
3536	msedge.exe

Suspicious use of WriteProcessMemory 32 IoCs

description	pid	Process	procid_target
PID 3536 wrote to memory of 4004	3536	msedge.exe	85
PID 3536 wrote to memory of 3712	3536	msedge.exe	86
PID 3536 wrote to memory of 800	3536	msedge.exe	87
PID 3536 wrote to memory of 800	3536	msedge.exe	87
PID 3536 wrote to memory of 800	3536	msedge.exe	87
PID 3536 wrote to memory of 4196	3536	msedge.exe	88
PID 3536 wrote to memory of 4196	3536	msedge.exe	88
PID 3536 wrote to memory of 2180	3536	msedge.exe	90
PID 3536 wrote to memory of 2180	3536	msedge.exe	90
PID 3536 wrote to memory of 2180	3536	msedge.exe	90
PID 3536 wrote to memory of 3800	3536	msedge.exe	91
PID 3536 wrote to memory of 3800	3536	msedge.exe	91
PID 3536 wrote to memory of 3800	3536	msedge.exe	91
PID 3536 wrote to memory of 5068	3536	msedge.exe	92
PID 3536 wrote to memory of 5068	3536	msedge.exe	92
PID 3536 wrote to memory of 2036	3536	msedge.exe	93
PID 3536 wrote to memory of 5068	3536	msedge.exe	92
PID 3536 wrote to memory of 2036	3536	msedge.exe	93
PID 3536 wrote to memory of 2036	3536	msedge.exe	93
PID 3536 wrote to memory of 4788	3536	msedge.exe	97
PID 3536 wrote to memory of 1960	3536	msedge.exe	98
PID 3536 wrote to memory of 4788	3536	msedge.exe	97
PID 3536 wrote to memory of 1960	3536	msedge.exe	98
PID 3536 wrote to memory of 2136	3536	msedge.exe	100
PID 3536 wrote to memory of 3448	3536	msedge.exe	109
PID 3536 wrote to memory of 3972	3536	msedge.exe	110
PID 3536 wrote to memory of 1820	3536	msedge.exe	111
PID 3536 wrote to memory of 992	3536	msedge.exe	113
PID 3536 wrote to memory of 992	3536	msedge.exe	113
PID 3536 wrote to memory of 1832	3536	msedge.exe	114
PID 3536 wrote to memory of 1832	3536	msedge.exe	114
PID 3536 wrote to memory of 1896	3536	msedge.exe	115

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://oneclient.sfx.ms/PreSignInSettings/Enterprise/2023-01-26-00-30-26/PreSignInSettingsConfig.json
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3536
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x2b8,0x7ffe46c8c188,0x7ffe46c8c194,0x7ffe46c8c1a0
  2⤵
  PID:4004
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1852,i,15891787984795491641,11385754983537986684,524288 --field-trial-handle=2356,i,9485256158837447509,5964675688364908175,262144 --variations-seed-version --mojo-platform-channel-handle=2444 /prefetch:3
  2⤵
  - System Time Discovery
  PID:3712
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1696,i,13300321443957019123,990603982131439496,262144 --field-trial-handle=2356,i,9485256158837447509,5964675688364908175,262144 --variations-seed-version --mojo-platform-channel-handle=2352 /prefetch:2
  2⤵
  PID:800
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2528,i,11570109030976365041,14665748482879708593,524288 --field-trial-handle=2356,i,9485256158837447509,5964675688364908175,262144 --variations-seed-version --mojo-platform-channel-handle=2532 /prefetch:8
  2⤵
  PID:4196
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3452,i,16478301384850369166,8304412101434527361,2097152 --field-trial-handle=2356,i,9485256158837447509,5964675688364908175,262144 --variations-seed-version --mojo-platform-channel-handle=3488 /prefetch:1
  2⤵
  PID:2180
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3456,i,17322915584138850971,8542571546694199366,2097152 --field-trial-handle=2356,i,9485256158837447509,5964675688364908175,262144 --variations-seed-version --mojo-platform-channel-handle=3504 /prefetch:1
  2⤵
  PID:3800
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4216,i,93227599602563318,13507332629177051508,2097152 --field-trial-handle=2356,i,9485256158837447509,5964675688364908175,262144 --variations-seed-version --mojo-platform-channel-handle=4256 /prefetch:1
  2⤵
  PID:5068
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4244,i,5452847661925211460,8422128826011571131,2097152 --field-trial-handle=2356,i,9485256158837447509,5964675688364908175,262144 --variations-seed-version --mojo-platform-channel-handle=4304 /prefetch:2
  2⤵
  PID:2036
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5136,i,12997909446596078667,11709243438170981355,524288 --field-trial-handle=2356,i,9485256158837447509,5964675688364908175,262144 --variations-seed-version --mojo-platform-channel-handle=5208 /prefetch:8
  2⤵
  PID:4788
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5156,i,12191694625520105081,1199059340397301805,524288 --field-trial-handle=2356,i,9485256158837447509,5964675688364908175,262144 --variations-seed-version --mojo-platform-channel-handle=5228 /prefetch:8
  2⤵
  PID:1960
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5556,i,2853345541158367928,3887989984527008107,524288 --field-trial-handle=2356,i,9485256158837447509,5964675688364908175,262144 --variations-seed-version --mojo-platform-channel-handle=5928 /prefetch:8
  2⤵
  PID:620
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5556,i,2853345541158367928,3887989984527008107,524288 --field-trial-handle=2356,i,9485256158837447509,5964675688364908175,262144 --variations-seed-version --mojo-platform-channel-handle=5928 /prefetch:8
  2⤵
  PID:2136
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4544,i,2898653319857462225,15135698914732165248,524288 --field-trial-handle=2356,i,9485256158837447509,5964675688364908175,262144 --variations-seed-version --mojo-platform-channel-handle=4324 /prefetch:8
  2⤵
  PID:3448
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4548,i,2914234137046021891,18010944772883560370,524288 --field-trial-handle=2356,i,9485256158837447509,5964675688364908175,262144 --variations-seed-version --mojo-platform-channel-handle=5932 /prefetch:8
  2⤵
  PID:3972
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4532,i,17380148710867083945,8172452395024136839,524288 --field-trial-handle=2356,i,9485256158837447509,5964675688364908175,262144 --variations-seed-version --mojo-platform-channel-handle=4496 /prefetch:8
  2⤵
  PID:1820
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4304,i,8653560621829473862,2524207617932771701,524288 --field-trial-handle=2356,i,9485256158837447509,5964675688364908175,262144 --variations-seed-version --mojo-platform-channel-handle=1052 /prefetch:8
  2⤵
  PID:992
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5824,i,4592128396882727487,9828912219052647722,524288 --field-trial-handle=2356,i,9485256158837447509,5964675688364908175,262144 --variations-seed-version --mojo-platform-channel-handle=4512 /prefetch:8
  2⤵
  PID:1832
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6172,i,4499673673555964502,18095592506631760004,262144 --field-trial-handle=2356,i,9485256158837447509,5964675688364908175,262144 --variations-seed-version --mojo-platform-channel-handle=6176 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1896

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:1752

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

0995ef0c-9059-4de3-8f5d-72b2c029a95c.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\0995ef0c-9059-4de3-8f5d-72b2c029a95c.tmp
Size 26KB
SHA256 4f86c603cd1d12dd47f949c9ac1ec3ebfdcbd6c3ba1a9af701863edf02c5e324
MD5 79c3f66efba0371ac9b0341118a3cda3
SHA1 1d43cd281d473f387baa12e958bd8d6c90a80911
SHA512 872359dfaa644a8e0d0f0b48e4b75928ab285ebb5f9ad687b9dcb9564ecf2b9b3b0ba570bce2db0c9beab566f87d500fdf192a82b5fa0603f29f2634cb962baa
SSDEEP 384:PiFzQkUSvdzsNB8TUNTUlIlyyZwutHX58EA8uJKXeJrHp2ILMtUSIIl4:aFdlEwgJp5aiehHp5CUSLO
TLSH
T10BC218F288D79937D9AE9743A77D2D038EBCC157B5846A50B3885A1CCC8A1BFD30AD11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

30c0e4ea-92e8-44e9-ae7f-83ca2c9b8da1.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\30c0e4ea-92e8-44e9-ae7f-83ca2c9b8da1.tmp
Size 8KB
SHA256 7e243a21ca6fb51a1a399c0c6d5a5d651d307530a1a446e97c4a9ba9cf8f9cd8
MD5 391eba3bff9fb79b72f0a2085d621c87
SHA1 9c0b168af21b32368c29a967bacbb02d04956bcb
SHA512 db72178fa8e8cb0abe1e6f72dd46185e85e1b5ef2aabbf1ec7943f71045447eb7e49eaf2c79d747340c18a63a514e9312dd4e69e0709433a5170ed3ae1868013
SSDEEP 192:iONS6wlDvQmiUydTv4X58gZYjzoruJKXrSJrmveVqIU6:iONS6kxgv4X58EA8uJKXeJrppU6
TLSH
T1C7120936E968AC3B5DE2A549F08735139EE94117D7897F90C6EC1B2C01DF2AC534AD23
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

671f79eb-8547-4643-aaf4-39540065330d.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\671f79eb-8547-4643-aaf4-39540065330d.tmp
Size 8KB
SHA256 ad3136cbb7e8d012ac7ca8ac2402592efefefe85d466fa0f3710baef4e6ddae5
MD5 36554f14201aef80a3174ae7412c408d
SHA1 e695c86dc018fe7cc9a2ccd90e1e2673a0ee0f2e
SHA512 2740600ec815851e5565701dd3bf9ad2bc656a246f3a32df4803464d5b520b54ca7e78b50b9b7b77d24833f23a0f4022a39840ce3e3648653e57e25336933caa
SSDEEP 192:1OND6wlDgQmiUyBTW4X58gZYjzoruJyDlz+U6:1OND6kgyW4X58EA8uJyCU6
TLSH
T1C002E835F9687C7B8EF2AD09B48727139FE5112BE6552F44D6E80A2D00DB69C2346D23
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

86604238-cd33-40d6-800d-de4d1ee431b5.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\86604238-cd33-40d6-800d-de4d1ee431b5.tmp
Size 18KB
SHA256 42e025544c784aaf17b30a173534b68a5743f1b94e8d2ced459943425a5fa08d
MD5 5be791c4f103725a7117054e817f02b9
SHA1 e7410e020fa6ed17bc4d5520ac89d8f44da276a7
SHA512 d149774fb326766211f6c856afb5d41f286617352d1ce074e38c26f94370d02c9a5d853949a2c7ef2d0bd2b7d4c9fb1891520b46559f825cdb560b17bb399f68
SSDEEP 384:wQkUSv0sNfyyZwHtHX58EA8uJKXeJrgp2ILMtUSIIl4:Y06I5aiehgp5CUSLO
TLSH
T101826D31ACA8AD3789F6E540F54E3613DEB88117D6882F94D6EC6B2C01CA2DD235BD16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 98f220c14bd3d385f1dd482d8b868745c75685e4a2573b4336f235cf3bdce6c1
MD5 6ce50f5d79ab86d6489a63e08ead9ec4
SHA1 d52fb22446c08230d0edc8374b1dcaed1af585ea
SHA512 fd66aaada3f82de40a9236f167ecb23bc285a49f72374f567e078118a8bdb229e4fadc26c639553cfacaa7d7ba44e0419f17b4bb4a9a8999b51bdd037a28783a
TLSH
T189D02BF4E69455E4D441283C11130304314CC4001C033010C46141D21D8D7C2009A068
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 02cf6c2debe9573f3713554c359339f3deb6fa4abd8c14fc6d2577e42ce2d830
MD5 eec56aca3717cde66f2f4d578de1d4d9
SHA1 965ee07ac77588f49d8c4fdf547b37349747a74f
SHA512 90d05594a407bba8ca844c3df6d127aec4c8ecb87f3d2106da447965d8445c3863cdc5a376c90818be642f5dbacedbbb845f24cc640f422e049733d24470df99
TLSH
T163D02BF4A6D459E4D841283C11130304314CC4001C037111C46141D20D8E7C2009A068
MD5 SHA1 SHA512 TLSH

Submit Download

04fdb1b4-3526-429e-af32-163d83ee0044.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\04fdb1b4-3526-429e-af32-163d83ee0044.tmp
Size 10KB
SHA256 05689c392930b9f42c7d497f17c69679075d3c9faf6132c6c9bd1b7a928a3198
MD5 6a0158a6d11596ddc1c73c46e0fcfe29
SHA1 69c760bfeb90226e5e58379b181f9833bec2b682
SHA512 e95f0ce65dcf227b93f343da71fbd70a534f4e03469c3da2d1e810ece04d66fa34037a43ff99b70910e81f861a510c654be1dc31289f1903c14e1e88a404ec6b
SSDEEP 192:sxZzRdWFb/fGs7+IdpMNHW6+WNYh+/YrOLO8Ig57J:sxZz+Fb/fGs7v8Hb//zj
TLSH
T1DA22B8526E28A97B8CCBE20DBB15BF13E6F9503251951E48E6FCC61C05E76CD2207C0B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

187ce9e9-c374-4f3b-ba3c-8bab95fc8be4.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\187ce9e9-c374-4f3b-ba3c-8bab95fc8be4.tmp
Size 9KB
SHA256 f501358f5712652a3891c745c7368abfabdfdcb243574e64d238dbb3aa8163eb
MD5 01614eee0c4aa970f5b68cc63db34f65
SHA1 636491db008c85e861d13822d8b0b55cc155d446
SHA512 f06f126ba0aa1a4647c746198ed8b1c0c1664cce7e2210f11a035074bc18ae11a70cfed263ade499f74e445e581cc58a59860bc601c681464b3aaf4c9164d6b1
SSDEEP 192:sxZzRdWFb/fGsZ+IdpMNHW6+WNYh+/YrUBO8Ig5BJ:sxZz+Fb/fGsZv8Hb//Bt
TLSH
T15222B6526E38A97B8CCBD21DBB15BF13E6F9503291D41E48EAFC861C05E66CD221780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

1e3306a2-4e42-4547-b00a-2c1bd7696c69.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\1e3306a2-4e42-4547-b00a-2c1bd7696c69.tmp
Size 27KB
SHA256 0aca960182cb8cba8f0fda759aa970cf5d306dc14368cd7e87117b688aa437ba
MD5 4401a6f81dcad6091735d953933d1e7d
SHA1 975e91d4e8f68b6232eb6f333e4801f235de902c
SHA512 5acb59fa177a32c8489e5a505b00e0c1a1957bf4a1f889461bbf387d943543f1fe4008d4d3b021c75f8110ab151391c20340dad1ac5c3921ea2e13a808c8af5e
SSDEEP 768:Wzy4J/DWvbtBh8F1+UoAYDCx9Tuqh0VfUC9xbog/OVCiLlc2TbJroRcx:Wzy4J/DWvbtBhu1jajiLm0biix
TLSH
T1ECC2FB3B684CCA7E4FC00A9DDD5E6FD73E9802C79A948D4047FA994C02C77EA91264DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

2aa06526-b7e1-4a10-b71b-51d836c47bd7.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\2aa06526-b7e1-4a10-b71b-51d836c47bd7.tmp
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 334B
SHA256 ee7388c076953419a3704cd878a1855d43fc00df0e08702a00fb4f62c0507fb2
MD5 5c42271c5f904c9f36b7a027ca46d935
SHA1 23678490a79f3e74b4758ef685b2df1a3cc59038
SHA512 8e7be113997f1fb52a5b4763d99c82bf30b70876bb3e9f1a619d5dfe21423d6431323f1d5c172021574af71d132d31c504bfd6cf571cff3d78bf76c865d871e1
TLSH
T122E0D8EA49C9C21E9208744B1278570C82902A2FD3C47A1D6704C98C700905CE293AA4
MD5 SHA1 SHA512 TLSH

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\temp-index
Size 3KB
SHA256 2076f31dba865a04007c6c423f870afb4147d66bfbb885999b4ddbd07c2a27d5
MD5 c077fec5d7ffb49a1fa4e8427eb101ab
SHA1 90ca161b8526e8d4c97be24d42aaa346adef73f5
SHA512 baf05f437e45241603e5dfa2d62dbab2312303737f71823af24c961eb7d5a429211d85ec02088275c2263c60f2c6303644e39a7ebec724e77468795924f796df
TLSH
T1D561A2F1B580D8DDFBE4917282E5DEC336B8B881DA833E6309A4F675F846B95900D49C
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 323933af7d085c5b54ac261b2424ecc36ddc37ec05eeefdf40b6f4d193194644
MD5 7ac882d007e97e97f218c29adea0e950
SHA1 39802d8934b7d73c33fc81716738ea68cf457a9f
SHA512 d9d65938d940a84273c6bd29a1bb329be9be3e1082649426c536f12ce9e21ec5635b991de609587630ba88b14d97a4ef5e226bc55a93f529f4400073f0ceeb6f
TLSH
T11761A2F1B680D8DDFBE4917282E5DEC736B8B881DA833E630964F675F846B95500C49C
MD5 SHA1 SHA512 TLSH

Submit Download

e553e977-16ed-462e-829b-ab51b43fd254.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\e553e977-16ed-462e-829b-ab51b43fd254.tmp
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

26a0bb2c-a99d-484a-bb7c-c667a99b0952.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\26a0bb2c-a99d-484a-bb7c-c667a99b0952.tmp
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

4887144b-6351-40b0-805b-ce72847586f0.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\4887144b-6351-40b0-805b-ce72847586f0.tmp
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

bbb4116a-8299-4748-bbba-94f566d9cdb5.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\bbb4116a-8299-4748-bbba-94f566d9cdb5.tmp
Size 949B
SHA256 bda4d6d88585ae391d9992cc99a015c3f7c2b74451b3ce191a68bc4fcfc91d5d
MD5 994cb165e13250af2ecf6eb7b5e70774
SHA1 1b43aaae015be6d6746fedbd848cbd3ee24277d9
SHA512 a1fd9aae3f90e63596818683b43b6a419e9dc7677aca3f2e5035ca4d0c22233fe13bac218771e8defd27dc205f8917e8c8585d2075f64e0d999ee9d1d5b6255b
TLSH
T1AE117DB3C7D5956E890556F05A28AE2BDE1D0516431C7C1A85D4EF2BD3F3075E00255F
MD5 SHA1 SHA512 TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 1a64d0cee1711a74a5f44de786ea333277666668b75caa89eb8a637b8cbc6001
MD5 32b22009a49cb366d512c95bb509db46
SHA1 8e23f651d48dc12fdb927a3c9c78fcca789eac37
SHA512 2bf18e3d57666f12c5a887fe11c51951a8df5b8dd27a1d4dde099ec09ffa98ac2a514debb541988daeeca466e578dc481b2c8ca65cdc45afdee857999b049140
SSDEEP 48:KIDI1Ks04jyL1i1t1w1c1i1A1g1xb181L1sIS101xK91411C1xx161hY1j101g1m:KIDCKs0+eb2Kws6yYgKNaK
TLSH
T183912F4571BB061038FD69988175CB2F035232773218E52B7FBC50A68E6BE086DFE9C9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

da5d5aa7-7f56-4c48-a496-22d66589ea56.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\da5d5aa7-7f56-4c48-a496-22d66589ea56.tmp
Size 9KB
SHA256 598e4aaa231d4b079537cad00e332bfd6a74250375916e1877a5d958a90d95b3
MD5 152567af072c1d2cc99f42a0246c63ba
SHA1 0865d43aba7a48bb154855a306a7f36309758529
SHA512 15e22356d4e3e3aae811857c6cad59b23a126959d1fb98cda5b75501ae4847c06c3fbc0af7f70840595cbcef03d22ee635cbb96914d11789d4e366579e1cab1e
SSDEEP 192:sxZzRdWFb/fGsZ+IdpMNHW6+WNYh+/YrUBO8IgrJ:sxZz+Fb/fGsZv8Hb//B9
TLSH
T1ED22A7526E38A97B8CCBD20DBA15BF13D6F9503291D51E58EAFCC61C05E66DD220780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

fb3a3d91-3068-42a7-989c-fc6af231c793.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\fb3a3d91-3068-42a7-989c-fc6af231c793.tmp
Size 10KB
SHA256 6db83743514977d5525cf1b4ddbf1b9f317505928957b54727be5c2cd57067db
MD5 aacfcec76b13f725784cc6776baff466
SHA1 154d10ce4b7173544e6ac8cc07b3c2d3cc154069
SHA512 d94eb8a2cf967921a741f4bc8ad4645bc72433fc0ea50d2ad9163773143246f915fa0bc139a1f5d49e19637665508a571aa222fd24959e2f25f5923b58e478a2
SSDEEP 192:sxZzRdWFb/fGs7+IdpeNHW6+WNYh+/YrAYO8Ig57J:sxZz+Fb/fGs7vOHb//Kj
TLSH
T17622B8526E38A97B8CCBD21DBA15BF13E6F9503251951E48EAFCC61C05E7ACD220781B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7555c76f-3c91-46d4-b0c9-919cc1067b64.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\7555c76f-3c91-46d4-b0c9-919cc1067b64.tmp
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
Size 3KB
SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
MD5 904e6e94a1d46374c8630cfd86cc729f
SHA1 e1d9c3f7813878acc6510d48d95b2bf48b2e1a0d
SHA512 081e2a26252860ff8d8f7a9d0378ae56f0cc50574d13d2a121afdf74284963747ef874a4d73b1df7774cd8570972f4f513eefe0a0325fd088556d5b1ba946712
TLSH
T1DB815C4FCC0CBE77ABAB6A719A35D6B2F79131EA94518A977F8C444EE3050ED0242E50
MD5 SHA1 SHA512 TLSH

Submit Download

ec34ec24-168f-4f5f-a192-1fed94b8fb84.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\ec34ec24-168f-4f5f-a192-1fed94b8fb84.tmp
Size 18KB
SHA256 b9afa78c09393b87260a429cc8f0ff767b7a2fdb77c93fe654dfc5a1c5895d78
MD5 8ecaba197962bd5cbae1fffe675cc9fd
SHA1 cda058a88eb5d739f34e1133d1655e7918cc6fff
SHA512 2aeeb46b69c78bfbc37b7d4b68ea7c119ba6b225691974534910d6362dacd70a122ba0e00325c65c624d7cc3618a3498b92b3f30d2415cd6a8e7fd7bfe481228
SSDEEP 384:tQkUSv0sNfHyZwHtHX58EA8uJKXeJrgp2ILMtUSIIl4:X0dI5aiehgp5CUSLO
TLSH
T15B827D32AC68AD3789F6E540F54E3603DEB88117D6882F94D6DC6B2C01CE2DD235BD16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

97788371-86ce-4a44-a2b5-8c3542c3cc7c.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\97788371-86ce-4a44-a2b5-8c3542c3cc7c.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 2198dd8594a633e9da6f58447a79c7fbdcbd6a4758129b2bf9ba86ae553979bb
MD5 ad9e3fbb26419d0fcc28afaa03fdaee8
SHA1 152baea46650c770077502adc9ce773684fc75fe
SHA512 4e86f540b47d58e19d6da51662d70686f55fb7694fb481526f40477564870400556e1ddf19aa9899880cda03a648bcf342951c408460d7c303fb6f92de1e3365
TLSH
T1AF41E958ABEE1148B3B62F5A9BF7A86D84BF78772E06D05D00120E4F0776740C8A1B37
MD5 SHA1 SHA512 TLSH

Submit Download