b12717d325e0c8618454c97415119fffa971ec651d8344ecc34b83d83be0e39e

Analysis

max time kernel
148s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
20/06/2026, 18:13

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
pd2.html
Size 3KB
Sample260620-wtppzagt8p
SHA256 b12717d325e0c8618454c97415119fffa971ec651d8344ecc34b83d83be0e39e
MD5 3a869c95fffc023b204fae8cbe5de072
SHA1 f560a98b1faf3006908d58c65827b3d0e451106d
SHA512 196a1525da3713b32f3830507332906e33881565114f66242cbb172dacf4a1c37321967cf310e7729fce7a3635540f362048ec168e42823223619ab971f622ff
TLSH
T19171D7057CE2B006517B22B57BEF119DB6A2510B7605CE24F89CC3205F94F9A4C6BBEC
MD5 SHA1 SHA512 TLSH

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
2428	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134264528004137869"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-540052884-2969440504-464782435-1000\{DFA531E7-22CD-4CC1-B4B8-FB8FE59166F0}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1656	msedge.exe
1656	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
1396	msedge.exe
1396	msedge.exe
1396	msedge.exe
1396	msedge.exe
1396	msedge.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
1396	msedge.exe
1396	msedge.exe
1396	msedge.exe
1396	msedge.exe
1396	msedge.exe
1396	msedge.exe
1396	msedge.exe
1396	msedge.exe
1396	msedge.exe
1396	msedge.exe
1396	msedge.exe
1396	msedge.exe
1396	msedge.exe
1396	msedge.exe
1396	msedge.exe
1396	msedge.exe
1396	msedge.exe
1396	msedge.exe
1396	msedge.exe
1396	msedge.exe
1396	msedge.exe
1396	msedge.exe
1396	msedge.exe
1396	msedge.exe
1396	msedge.exe
1396	msedge.exe
1396	msedge.exe
1396	msedge.exe
1396	msedge.exe
1396	msedge.exe
1396	msedge.exe
1396	msedge.exe
1396	msedge.exe
1396	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
1396	msedge.exe
1396	msedge.exe
1396	msedge.exe
1396	msedge.exe
1396	msedge.exe
1396	msedge.exe
1396	msedge.exe
1396	msedge.exe
1396	msedge.exe
1396	msedge.exe
1396	msedge.exe
1396	msedge.exe
1396	msedge.exe
1396	msedge.exe
1396	msedge.exe
1396	msedge.exe
1396	msedge.exe
1396	msedge.exe
1396	msedge.exe
1396	msedge.exe
1396	msedge.exe
1396	msedge.exe
1396	msedge.exe
1396	msedge.exe
1396	msedge.exe
1396	msedge.exe
1396	msedge.exe
1396	msedge.exe
1396	msedge.exe
1396	msedge.exe
1396	msedge.exe
1396	msedge.exe

Suspicious use of WriteProcessMemory 30 IoCs

description	pid	Process	procid_target
PID 1396 wrote to memory of 4080	1396	msedge.exe	86
PID 1396 wrote to memory of 2660	1396	msedge.exe	87
PID 1396 wrote to memory of 2428	1396	msedge.exe	89
PID 1396 wrote to memory of 2660	1396	msedge.exe	87
PID 1396 wrote to memory of 2660	1396	msedge.exe	87
PID 1396 wrote to memory of 1672	1396	msedge.exe	90
PID 1396 wrote to memory of 1672	1396	msedge.exe	90
PID 1396 wrote to memory of 4100	1396	msedge.exe	91
PID 1396 wrote to memory of 4232	1396	msedge.exe	92
PID 1396 wrote to memory of 4100	1396	msedge.exe	91
PID 1396 wrote to memory of 4100	1396	msedge.exe	91
PID 1396 wrote to memory of 4232	1396	msedge.exe	92
PID 1396 wrote to memory of 4232	1396	msedge.exe	92
PID 1396 wrote to memory of 220	1396	msedge.exe	93
PID 1396 wrote to memory of 220	1396	msedge.exe	93
PID 1396 wrote to memory of 220	1396	msedge.exe	93
PID 1396 wrote to memory of 224	1396	msedge.exe	94
PID 1396 wrote to memory of 224	1396	msedge.exe	94
PID 1396 wrote to memory of 224	1396	msedge.exe	94
PID 1396 wrote to memory of 2936	1396	msedge.exe	99
PID 1396 wrote to memory of 3792	1396	msedge.exe	100
PID 1396 wrote to memory of 2936	1396	msedge.exe	99
PID 1396 wrote to memory of 3792	1396	msedge.exe	100
PID 1396 wrote to memory of 2456	1396	msedge.exe	102
PID 1396 wrote to memory of 4416	1396	msedge.exe	112
PID 1396 wrote to memory of 1836	1396	msedge.exe	113
PID 1396 wrote to memory of 3624	1396	msedge.exe	114
PID 1396 wrote to memory of 2212	1396	msedge.exe	115
PID 1396 wrote to memory of 2212	1396	msedge.exe	115
PID 1396 wrote to memory of 1656	1396	msedge.exe	117

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument C:\Users\Admin\AppData\Local\Temp\pd2.html
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1396
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x24c,0x7ff84d7cc188,0x7ff84d7cc194,0x7ff84d7cc1a0
  2⤵
  PID:4080
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1700,i,11727347215780633042,15071041249856075171,262144 --field-trial-handle=2252,i,6762269811844854128,16001481245079255288,262144 --variations-seed-version --mojo-platform-channel-handle=2248 /prefetch:2
  2⤵
  PID:2660
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1956,i,7018585564666342078,4333697517751571119,524288 --field-trial-handle=2252,i,6762269811844854128,16001481245079255288,262144 --variations-seed-version --mojo-platform-channel-handle=2288 /prefetch:3
  2⤵
  - System Time Discovery
  PID:2428
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2488,i,16515775307928702941,3090713261940553768,524288 --field-trial-handle=2252,i,6762269811844854128,16001481245079255288,262144 --variations-seed-version --mojo-platform-channel-handle=3088 /prefetch:8
  2⤵
  PID:1672
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3436,i,3880768666560287151,7068640349079000637,2097152 --field-trial-handle=2252,i,6762269811844854128,16001481245079255288,262144 --variations-seed-version --mojo-platform-channel-handle=3504 /prefetch:1
  2⤵
  PID:4100
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3440,i,14578312138257942373,6340015652285590115,2097152 --field-trial-handle=2252,i,6762269811844854128,16001481245079255288,262144 --variations-seed-version --mojo-platform-channel-handle=3508 /prefetch:1
  2⤵
  PID:4232
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4204,i,13936553845766932315,5217196326714152930,2097152 --field-trial-handle=2252,i,6762269811844854128,16001481245079255288,262144 --variations-seed-version --mojo-platform-channel-handle=4184 /prefetch:1
  2⤵
  PID:220
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4256,i,14836629985750508155,5009575070461876546,2097152 --field-trial-handle=2252,i,6762269811844854128,16001481245079255288,262144 --variations-seed-version --mojo-platform-channel-handle=4216 /prefetch:2
  2⤵
  PID:224
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3424,i,2057382513861588865,6160971897622797635,524288 --field-trial-handle=2252,i,6762269811844854128,16001481245079255288,262144 --variations-seed-version --mojo-platform-channel-handle=5136 /prefetch:8
  2⤵
  PID:2936
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3648,i,4367846730887772936,17397274842254152953,524288 --field-trial-handle=2252,i,6762269811844854128,16001481245079255288,262144 --variations-seed-version --mojo-platform-channel-handle=5140 /prefetch:8
  2⤵
  PID:3792
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5784,i,4618821950906010400,15959896968926943731,524288 --field-trial-handle=2252,i,6762269811844854128,16001481245079255288,262144 --variations-seed-version --mojo-platform-channel-handle=5804 /prefetch:8
  2⤵
  PID:4968
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5784,i,4618821950906010400,15959896968926943731,524288 --field-trial-handle=2252,i,6762269811844854128,16001481245079255288,262144 --variations-seed-version --mojo-platform-channel-handle=5804 /prefetch:8
  2⤵
  PID:2456
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4496,i,9339667221097893809,17404725293281603190,524288 --field-trial-handle=2252,i,6762269811844854128,16001481245079255288,262144 --variations-seed-version --mojo-platform-channel-handle=4468 /prefetch:8
  2⤵
  PID:4416
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5828,i,16840598079585439533,6565301186111548917,524288 --field-trial-handle=2252,i,6762269811844854128,16001481245079255288,262144 --variations-seed-version --mojo-platform-channel-handle=4460 /prefetch:8
  2⤵
  PID:1836
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5836,i,15917909056323932506,10376414230920773391,524288 --field-trial-handle=2252,i,6762269811844854128,16001481245079255288,262144 --variations-seed-version --mojo-platform-channel-handle=4360 /prefetch:8
  2⤵
  PID:3624
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5384,i,13292239661770491614,11557095682539256791,524288 --field-trial-handle=2252,i,6762269811844854128,16001481245079255288,262144 --variations-seed-version --mojo-platform-channel-handle=5272 /prefetch:8
  2⤵
  PID:2212
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6116,i,1002275683968761445,15658175931417078834,262144 --field-trial-handle=2252,i,6762269811844854128,16001481245079255288,262144 --variations-seed-version --mojo-platform-channel-handle=5908 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1656

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:4268

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

1432ecee-a0a6-420a-ba66-9d5c45c3c23a.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\1432ecee-a0a6-420a-ba66-9d5c45c3c23a.tmp
Size 18KB
SHA256 8a4f8a4f9480744256b0a6c034ad08acf38177111bd2946dfd056a899c75254f
MD5 bdb3adb593d69a891383329f324865d6
SHA1 f1d0dee8b85290b3ea3b8f63590f9cf0585c36b5
SHA512 260f6a09f12f5e6a0d649aa1f5307916097e6989d7717a6245258dc7e8a5554aa0e0c1922ab6c5c7c8393293b84df3ef3d92640090c2188106a2f472d71adc26
SSDEEP 384:nF1tNn/s3n9S0zsNf8TUNTUlIlb/nIBb6J0x4VRNaEFjcby6x9j:nF1j+932wgxInuHaKjcblvj
TLSH
T177825A3358649C3B9DE6AE45F98B32174EB491A7DAC57E90E6DC5F0C00DB19C130BE1A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

blocklist

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\blocklist
Size 105KB
SHA256 9420686d12b2cba6dc69896d607eadac629280a010e5358a4872ab9753f24ed7
MD5 8be6e81804d8b903ae07c11b2e53e3d9
SHA1 817c41cb00b05a8f2040323b93c6416b92dbc01b
SHA512 c2cfff48ebb312975aa2615d841d0badff185589ad3a3f5e8420c2ea0eb5dc0e5354d917cc43d57bec169a63d4fa21d66e91dc3e195592ece23d37fff7c04680
SSDEEP 1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P7R:fwUQC5VwBIiElEd2K57P7R
TLSH
T1CDB3B931457E36BF26E93EE828CF1511B84F3912624895D4ABE1FE2C4845E68633CEF4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 0e2b315c59b1bfe8e547b0017a92548af7c81e08409e987a2628ad74667b4fec
MD5 7ab616f55807e9de5195a40c50f65e5b
SHA1 917a7797f800e5f30a1b9b8125127968246d7ce9
SHA512 da10f29803a072f42a2c102da0bee745cf1b1d47836e3d30e38b1e66beeb1abeaf2eb47b6c07b23682098f70fe2a4b29a0777eefa1380d0fff2509ff32d9b356
TLSH
T171D08023771D7182F35B41759053D7025A1680756463B701B325D41C9A740C9F28B1C2
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 b976ac8901ffd41ec02a04aa583bc9d11350f0f9f714fb92d3341bb0bde4629f
MD5 504ce80b644a85a7e68d85bd24169289
SHA1 1f740a722dfa97fc8fb30626b0e3d6217e4a9864
SHA512 9406464a4f6becd85591c12af8a97fdecfa2208649138f347fb50d3e28f1583adec061050924fa0405e46eb75af7e299e6564c2ed039db9d82c50326da32a3c5
TLSH
T19ED08023371D7582F75B41759053D7025A1680756463F701B325D41C9A750C9F28B1C2
MD5 SHA1 SHA512 TLSH

Submit Download

1b2452da-4191-43e3-8123-518e497cc07e.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\1b2452da-4191-43e3-8123-518e497cc07e.tmp
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 4375bbf0cbe91017814831dfa8a70e451998c6f43251cb5e9724684149fe8cc5
MD5 bd02f08f239024b0c630630e5ecc5c4d
SHA1 9398baca9daea5336a1db12929d58a588acfcbf6
SHA512 3ef76b1a56a8f6024a34c11486646c6ad3a7a558919cdece329ba1edf390e45ee9e01e8d2223d49aabf15b68bbd14da15f6af40a509d11d7b070a5e001a3848d
TLSH
T1B17161BC020701A1E356933A68D3C5D63CF18BCAF96BFDE61210D4BE26D57618278F50
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe58b4b5.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe58b4b5.TMP
Size 3KB
SHA256 6b184777600b90f9adc10c667d2ca439a04e519f1167714cfc3d263fa2bdd3f6
MD5 01871937b555a175d26a08d5f3e63c30
SHA1 1564e7f0399cbf165ec947b789c59670ad12943f
SHA512 83a8e1be595e1faf5b4d2786862f2aebe2f7417b92007b2528b9f9ec1f6d690d42b935b27bbc37d5a1e50f80177043be09b7b45411f2af59abd7b2a88fa4915a
TLSH
T1C97161BC020701A1E352933AA8D3C1D63CF18BCAF96BEDE61110D4BE26D67618278F50
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

HubApps

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\HubApps
Size 106KB
SHA256 eb2fd7422436fff93f6be09df3294b26cdb7afd18e6aa94dcdc0f208db78b2ed
MD5 25dca813dd764f2197142ef84bc5ce66
SHA1 8d6aefb01ee9f6d1fb0cfd89326cfe35af53a53d
SHA512 a9c8cd547c874b7b69cbb3a0c8214f43837911e522db768dcd075d23d05acfd7122cf2bcad281ea745025e4fb67cc9061b79f9dc1288ac1a113bd0d961841d43
SSDEEP 1536:IfEEtnH74ohBGZqW3iPPDuVvpBI/SvtZsA62UYPq:BuHSRhPjU1
TLSH
T154B35226D6A54C6B01F16264EC794382F325436F9282A82F3B7C5D5C2FBD93A6502F7C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 1KB
SHA256 8e98ea355609cd3205089426a5a0cb7575869506f5ad70f21e2b7027e159bc8b
MD5 f46a69d1ffdcc5f64fb97c75520d6bd8
SHA1 c67be7002bb7eaaed9f0c18a09a765206516d6f4
SHA512 4c4c529fc5377726a60de940d24a75b3903e33e8f63c8e1a3fe78b849295c4f36ca78afd0799f4f3994b5b9438193d6ab350cb9ea830b007530f81e9ed5ab316
TLSH
T1AB11ADB6C6D487AE885116F46B24BD2BCD1D050A42283C1989F4EF5F93E24B5D10125F
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 126c1a5747b7ae5a45be8306c9e1deaa737522b6904d987293f2c622d03fa9c0
MD5 f7fe294d883db0590f13128a9bbca3c9
SHA1 b980669453a9656905e2ae19c949bfa3451af0e7
SHA512 173c6c466bc0ac388c4eabb9c6d526355cc0023f2e97ad38764bf4a7da4802968fd181d884f53a51bc6d8391cb1cc243aff5f61a2fb4266f5f58d28d8ddd9747
SSDEEP 192:sxZPVRVyM/jK1Ml8MkQ/fRsDenIdpdvHW6+WNGYIkPWsIgrJ:sxZPVRMQ/fRsDeotHbGA9
TLSH
T16042F8126B346977CCDBD209FA55BF53D6F55572E2900E44A9FCCA0C04E6AEC220782F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 8f92c28e4e4cf73c80561bc8c5f7c1417a2eb0860549c23bab8243ca0a8180fd
MD5 89ad1f3e8c48cce573a4ab348ba9d96c
SHA1 de0c09e303964cb7ff0e66d6920ef64f472e0629
SHA512 88c5205518645ec80e2b6441aa6834e6252656d6de7e7cfe887818f8831c34cdf6e1d75a6aaf0e41f3d5ea69e5b831855ea6c4b0ef54b3bf1be8d0c5a8bf94c4
SSDEEP 192:sxZPVRVyM/jK1Ml8MkQ/fRs0BVIdpdvHW6+WNGYISrpWsIg51J:sxZPVjMQ/fRs0BmtHbGodR
TLSH
T19452E8126A346977CCDBE209FA45BF53D6F54572E2900E44AAFCCA0C04E6ADD220782F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 5611dea2653b97e4e02e541914e5463888b31be305edee238870c78f25f423f2
MD5 f5d22eda88afca1b8d6e4c740193dc61
SHA1 d497cb3b12f91da24c3ed1ed33f681f7fff6f89a
SHA512 819594eb5a6053996773a6279dd2e45226f995c022cd5bf59d92bdc87fa6d6097a6862dc72dbe672c6419ef33d6eb98b937c350e91e6b9ca68fb73bf7eaf6bc7
SSDEEP 192:sxZPVRVyM/jK1Ml8UQskQ/fRs0BVIdpHvHW6+WNGYI/8rC0sIg51J:sxZPVjq3Q/fRs0BmPHbG58wR
TLSH
T1C652E7126A349977CCDBE20DF985BF53D6F54572E2900E44AAFCCA0C04E6ADD221782F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 30KB
SHA256 edd532efa4448607fc647ffd5f0bb796c85a78aaba92ac48206cd9fa46f315b3
MD5 35d889a3451a2fb57a4ac586cab5094a
SHA1 5c894a5ef87d17fc5d8d7f2de2ac111aab84d376
SHA512 8edc563e02e30c7f28e9484a68f1da61b7878e2bbe8c902d56637ce7c776f8b271b61f286d443f186c116964d65037df99f6fc778d56b19bc56b4e81822be85e
SSDEEP 768:8CsqxXlWvJD6T8F1+UoAYDCx9Tuqh0VfUC9xbog/OVk4Ll6AR9fro9C5:8CsqxXlWvJD6Tu1ja54LAs9M9K
TLSH
T118D21B3B694CC77E4F840E5DEC266FD76ED801CBA6988D5447FA880C03CB2EA11165DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 6KB
SHA256 6be55228c9ea8dce7cf34195b0d7b65fc4144b243a2a2ba1f40dcaccbfb2df07
MD5 d828b1688bb2bdf9f7d09c0639777b44
SHA1 032d9281983df103bb664706036bcc06424a208a
SHA512 779485d84549c25e24e39dc43cd1dd83e54fb540d488fb5dda05a429fb75a678561a7c2b2e1a76fa85c00a4713ee2384d9d1f76056c162995883040307bf3765
SSDEEP 96:KYbaKYIKScgKVWeS8AKhumJqKaoyKWoK3qz:ExbPz4h3o
TLSH
T162E10606713E061239FE1988B2A685374F423163705CA86F7FB950A50E6BE235DFD8ED
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 12KB
SHA256 b4caca72b0b4a4ed16e13d2465565fdb00fdfc109cc277d95cbf5f2427c7399d
MD5 95eebecdca73091bd9e6d0c911a26187
SHA1 8d63266644b34f318dea4ebcfd9a15ac63feaea5
SHA512 aba59958b32ea3b5a33d7d4a7ca8e93142edf06230792c8b802ad9c16dc0d95fd37c27e421e52542589541519b397384e66cc836a718ef52f44f892c060d066f
SSDEEP 192:uOLsNFPQMDpBIOkRbZAnQmiU1eL1n4VRNfCk7OmqZZGSRxqL3iy1Db/y:LsNFP/nIBb6J0x4VRNaE6jcb/y
TLSH
T1714219766C786C3B8DE6A505F58B36135FB491A7EBC82F80D5ED1B0C01DB59C230A92A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 7d3ebd78802d5bf23a4a61d4fe8ff8bcfa98c7bad0352b0e7f2a224b339b5453
MD5 5e5cdc4532b34f24c886916e91773d28
SHA1 6e333355694f29c041940646c5e641721fb578b4
SHA512 90e1b99d350d23f57fa838eed97928e1c772b1c8338274dd1f199c3f619fb62164416e220e7e9f10e4af317ad445889397094d21a2289ca1aec94b7229e72a50
SSDEEP 192:tONC6JkRtQmiUy9rW+RNfCk7Omth3tRwU6:tONC6Ur2W+RNaET8U6
TLSH
T11C02FB357C386C7B8EF2AD05B48B27171FA5216BF9952F80DAD81B1C01D7A9C234793A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 16KB
SHA256 f6ec9211aab3f0ef203fc33f6802c47067afe7ef4f84ae184a7fe064a0d14afa
MD5 77936c3be32e1589de8ef3add5014a4a
SHA1 a4e08483103dd153024e45c543e5f7b958480d9d
SHA512 9c34aaa3794c5f9621cd7764dff40220339460b17529d54f8656544e148e27c9dc2abcefa7e903ad7233acbacaf7ab7ed4e1f06d2622280ce17caf5e27b72e2a
SSDEEP 384:ctNn/s3n9SfsNFb/nIBb6J0x4VRNaE6jcby6x9j:cj+9UiInuHaXjcblvj
TLSH
T160725C326C346C3B8DE6A545F58B36171FB491A7EAC92F80D9ED5F0C01DB69C1307A1A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 3a38b9d5813ab13133aa2384f8c6a475cd6b764015d9144fc91905299984cd01
MD5 357dcbb0f8f0506ac70095b4e1d2aa4e
SHA1 f47d529d1555a31f1d3459dd0244cf8e4ed83b47
SHA512 5c6826ac8b26322f17174416848bc8bdb6a6de2bbd91acead5879e69b7c27096bae617b7e8b2ce3390d57da77080e7886c1e8fb839171fbb7ee092b8bb2bc979
SSDEEP 192:YONI6JkRRQmiUycTrI+RNfCk7OmqZZCVcxqL3iU6:YONI6UvP3I+RNaE4jU6
TLSH
T15F12F9366C686C7B8EE2B845B4C732135FB59167FE896F40D5DC1E1C01DF99C230A92A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\metadata.json
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 0adedddf85a8ca3114557d685202993299f396465ad8b9345cd948a1c2cb05a2
MD5 0f69064751ca9645ecdda428d6070859
SHA1 7e40508c0cc50f57ca1d7c2d5f8f63d1b94d33d1
SHA512 4f13b46628c0d565ef527ad5b17f60d335cbffada7130e944e718301077f554827786dcd382f96493531b6e95209c752ba36f467320659aad68a79ba5f72ad5b
TLSH
T177413A5CB6E91148B3B76F569BF6B86E447FB9772F47D59D00010D4E0A22A40C8B2737
MD5 SHA1 SHA512 TLSH

Submit Download