4b8f6a3927c6d18720e4f85e28b2403638e4ba51f86790e1063005057df64fe6

Analysis

max time kernel
148s
max time network
138s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
22/06/2026, 10:46

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
download_eddf6ca4-8013-4378-b243-20e0ea76c631.html
Size 222KB
Sample260622-mt3gdsbw21
SHA256 4b8f6a3927c6d18720e4f85e28b2403638e4ba51f86790e1063005057df64fe6
MD5 4a0dc3be7baea6d0b4bfcded19eaecf5
SHA1 dd7faa8fbf407a1b06a6b0f00477168133a82b39
SHA512 e8ee6a3570633ea7782fa7563c3365013cd6d5b9a2dd7728e60e2e832cef8ba9399ca11ceb46230349ff0b3fc38cc193944909cb32eec164ba4ae1e18206c167
SSDEEP 6144:2EPcQFY1LaRdhOuXOYMLO3/mGLwe8HMJ10PQyDtBxO7AY/txaLS+7Y+M:2GCLaRdhOuXOYMLO3/mGLwe8HMJ10PQF
TLSH
T1F82410278400DE2699168A3D0A79EF759054CB7ECEE5670CE2EFDB46011CCF90BBA971
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
840	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134265987803679246"	msedge.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-668679576-120646659-2289335452-1000\{EC2566CA-FD98-4A06-849E-6E34CB41B381}	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1172	msedge.exe
1172	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
2352	msedge.exe
2352	msedge.exe
2352	msedge.exe
2352	msedge.exe
2352	msedge.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
2352	msedge.exe
2352	msedge.exe
2352	msedge.exe
2352	msedge.exe
2352	msedge.exe
2352	msedge.exe
2352	msedge.exe
2352	msedge.exe
2352	msedge.exe
2352	msedge.exe
2352	msedge.exe
2352	msedge.exe
2352	msedge.exe
2352	msedge.exe
2352	msedge.exe
2352	msedge.exe
2352	msedge.exe
2352	msedge.exe
2352	msedge.exe
2352	msedge.exe
2352	msedge.exe
2352	msedge.exe
2352	msedge.exe
2352	msedge.exe
2352	msedge.exe
2352	msedge.exe
2352	msedge.exe
2352	msedge.exe
2352	msedge.exe
2352	msedge.exe
2352	msedge.exe
2352	msedge.exe
2352	msedge.exe
2352	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
2352	msedge.exe
2352	msedge.exe
2352	msedge.exe
2352	msedge.exe
2352	msedge.exe
2352	msedge.exe
2352	msedge.exe
2352	msedge.exe
2352	msedge.exe
2352	msedge.exe
2352	msedge.exe
2352	msedge.exe
2352	msedge.exe
2352	msedge.exe
2352	msedge.exe
2352	msedge.exe
2352	msedge.exe
2352	msedge.exe
2352	msedge.exe
2352	msedge.exe
2352	msedge.exe
2352	msedge.exe
2352	msedge.exe
2352	msedge.exe
2352	msedge.exe
2352	msedge.exe
2352	msedge.exe
2352	msedge.exe
2352	msedge.exe
2352	msedge.exe
2352	msedge.exe
2352	msedge.exe

Suspicious use of WriteProcessMemory 30 IoCs

description	pid	Process	procid_target
PID 2352 wrote to memory of 4936	2352	msedge.exe	88
PID 2352 wrote to memory of 840	2352	msedge.exe	89
PID 2352 wrote to memory of 3676	2352	msedge.exe	90
PID 2352 wrote to memory of 3676	2352	msedge.exe	90
PID 2352 wrote to memory of 3676	2352	msedge.exe	90
PID 2352 wrote to memory of 3540	2352	msedge.exe	91
PID 2352 wrote to memory of 3540	2352	msedge.exe	91
PID 2352 wrote to memory of 4208	2352	msedge.exe	93
PID 2352 wrote to memory of 4208	2352	msedge.exe	93
PID 2352 wrote to memory of 4208	2352	msedge.exe	93
PID 2352 wrote to memory of 1724	2352	msedge.exe	94
PID 2352 wrote to memory of 1724	2352	msedge.exe	94
PID 2352 wrote to memory of 1724	2352	msedge.exe	94
PID 2352 wrote to memory of 3716	2352	msedge.exe	95
PID 2352 wrote to memory of 4628	2352	msedge.exe	96
PID 2352 wrote to memory of 3716	2352	msedge.exe	95
PID 2352 wrote to memory of 3716	2352	msedge.exe	95
PID 2352 wrote to memory of 4628	2352	msedge.exe	96
PID 2352 wrote to memory of 4628	2352	msedge.exe	96
PID 2352 wrote to memory of 396	2352	msedge.exe	102
PID 2352 wrote to memory of 4484	2352	msedge.exe	103
PID 2352 wrote to memory of 396	2352	msedge.exe	102
PID 2352 wrote to memory of 4484	2352	msedge.exe	103
PID 2352 wrote to memory of 2728	2352	msedge.exe	105
PID 2352 wrote to memory of 4440	2352	msedge.exe	112
PID 2352 wrote to memory of 2300	2352	msedge.exe	113
PID 2352 wrote to memory of 3504	2352	msedge.exe	114
PID 2352 wrote to memory of 2020	2352	msedge.exe	116
PID 2352 wrote to memory of 2020	2352	msedge.exe	116
PID 2352 wrote to memory of 1172	2352	msedge.exe	117

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument C:\Users\Admin\AppData\Local\Temp\download_eddf6ca4-8013-4378-b243-20e0ea76c631.html
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2352
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x2b4,0x7ff95b73c188,0x7ff95b73c194,0x7ff95b73c1a0
  2⤵
  PID:4936
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1952,i,11431781780722997185,1082201842016706816,524288 --field-trial-handle=2320,i,9562741220002129421,12079967278353386889,262144 --variations-seed-version --mojo-platform-channel-handle=2396 /prefetch:3
  2⤵
  - System Time Discovery
  PID:840
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1752,i,3384825079113767057,14843822613568310595,262144 --field-trial-handle=2320,i,9562741220002129421,12079967278353386889,262144 --variations-seed-version --mojo-platform-channel-handle=2316 /prefetch:2
  2⤵
  PID:3676
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2608,i,3475940303428913557,6026133401394402088,524288 --field-trial-handle=2320,i,9562741220002129421,12079967278353386889,262144 --variations-seed-version --mojo-platform-channel-handle=2740 /prefetch:8
  2⤵
  PID:3540
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3440,i,17411945044060360765,8344607914122810246,2097152 --field-trial-handle=2320,i,9562741220002129421,12079967278353386889,262144 --variations-seed-version --mojo-platform-channel-handle=3500 /prefetch:1
  2⤵
  PID:4208
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3460,i,6658802689227506434,30863146789374076,2097152 --field-trial-handle=2320,i,9562741220002129421,12079967278353386889,262144 --variations-seed-version --mojo-platform-channel-handle=3544 /prefetch:1
  2⤵
  PID:1724
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4256,i,899895192645532478,3344702384556697034,2097152 --field-trial-handle=2320,i,9562741220002129421,12079967278353386889,262144 --variations-seed-version --mojo-platform-channel-handle=4312 /prefetch:1
  2⤵
  PID:3716
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4292,i,16944607592307918193,13102837011646775878,2097152 --field-trial-handle=2320,i,9562741220002129421,12079967278353386889,262144 --variations-seed-version --mojo-platform-channel-handle=4356 /prefetch:2
  2⤵
  PID:4628
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5084,i,13770187323491543775,16223714015080356828,524288 --field-trial-handle=2320,i,9562741220002129421,12079967278353386889,262144 --variations-seed-version --mojo-platform-channel-handle=5180 /prefetch:8
  2⤵
  PID:396
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5088,i,5624646624662186524,14288252650790752569,524288 --field-trial-handle=2320,i,9562741220002129421,12079967278353386889,262144 --variations-seed-version --mojo-platform-channel-handle=5200 /prefetch:8
  2⤵
  PID:4484
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5780,i,5014743768032078890,4558058657127363100,524288 --field-trial-handle=2320,i,9562741220002129421,12079967278353386889,262144 --variations-seed-version --mojo-platform-channel-handle=5796 /prefetch:8
  2⤵
  PID:4436
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5780,i,5014743768032078890,4558058657127363100,524288 --field-trial-handle=2320,i,9562741220002129421,12079967278353386889,262144 --variations-seed-version --mojo-platform-channel-handle=5796 /prefetch:8
  2⤵
  PID:2728
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3648,i,13699506024381974352,13052331231050563797,524288 --field-trial-handle=2320,i,9562741220002129421,12079967278353386889,262144 --variations-seed-version --mojo-platform-channel-handle=4292 /prefetch:8
  2⤵
  PID:4440
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4368,i,15203893348704512850,8403848331185411368,524288 --field-trial-handle=2320,i,9562741220002129421,12079967278353386889,262144 --variations-seed-version --mojo-platform-channel-handle=4280 /prefetch:8
  2⤵
  PID:2300
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4348,i,5235885808844992827,11571796713035693711,524288 --field-trial-handle=2320,i,9562741220002129421,12079967278353386889,262144 --variations-seed-version --mojo-platform-channel-handle=4488 /prefetch:8
  2⤵
  PID:3504
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5192,i,857257674564376728,13856138326032522886,524288 --field-trial-handle=2320,i,9562741220002129421,12079967278353386889,262144 --variations-seed-version --mojo-platform-channel-handle=2140 /prefetch:8
  2⤵
  PID:2020
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6112,i,6902862875161801692,6592760281642991015,262144 --field-trial-handle=2320,i,9562741220002129421,12079967278353386889,262144 --variations-seed-version --mojo-platform-channel-handle=6104 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1172

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:4256

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

blocklist

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\blocklist
Size 105KB
SHA256 bf637ca0b28ebd6e948876848ccfe71d201158d460d4ad944f124f9d17ee5472
MD5 827e00d89fccbbde703c679b5c7ff536
SHA1 6d9e235782beb4e6b38fd4db2946f9bfc725110c
SHA512 1d18100db386f25678d8dabb492ab6e15d08e2c5a7d7e6c76bc253df648e2b5438cbc4fcb5a4033a1e14afbda93b271225eb5f545f12663d6bc35ca51239fcc3
SSDEEP 1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P7X:fwUQC5VwBIiElEd2K57P7X
TLSH
T148B3B931457E36BF26E93EE828CF1511B84F3912624895D4ABE1FE2C4845E68633CEF4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CrashpadMetrics-active.pma

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\CrashpadMetrics-active.pma
Size 16KB
SHA256 814d47aad78c212b52568b9c7b58d242899d490d3afebce66181cae50c880df5
MD5 8c7cdfea4284ba987d295d82a9c7ddd6
SHA1 7d1a3a66f2d64a383b230196ba89a263ce7ee957
SHA512 59c8229e834c944265aed4131c79f41f9f940a48651b9fb18800cef5bae36d17c7fd5880120c6fee8ce22a157b65bc63846b65765bc4dc86e15926dcce400d0d
SSDEEP 12:sf9iXhV0xoUZxCe+JKlkQuMRxCb8TXuYJ0IJpPK6BsyW1inPiz:U9iRqxoUZxWMk8xVTeYWI31BtXP
TLSH
T105724C85B34498FFC8835E7189BD27903774F6DF1F02866B6A6A760E2E271C84F44224
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 1c8e6fcbb66aba64fe595f222fc4117e00e82ccdc0eef2100a1b4f7babb04f87
MD5 398d1e7948d46a763209c466fdacd0fb
SHA1 b26f2c32bc106089a59ce779d792beaba59f92bf
SHA512 a0bbf31d803e7333d004f03de9c261732d00cceb5d82dd64b5f0decf8adc8b840891187c72bb21cce83873e6d4dd2fab89d4c7efa320afe2ef3589678dcb1424
TLSH
T1B6D080277A196004F3964175A483D7061319956129575711F310C44CA9775D553C11C2
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 5d2c4e39ddbeb0ac61628bae04f1ac5787600ec893b0e230d1a84d61470771a9
MD5 cd6e704306442404371caebfec7f5b29
SHA1 e4beab8b7820af3633bf7c75a5498a958a95832e
SHA512 de66681a9245e8ece7d7e2ea2080251c395f2aeb8a885ac007eaf16f2ee3a3e36610d2afc17be964a038704371cedfbe4da91143ebed5adac20dbda97768d6e6
TLSH
T13AD080273A196404F7964175A483D7061319956129579712F310C44C99775D553C11C2
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 dd74940ea5ea7850ecab9268750a09eed38ec05823276e4fd455f67db47601a4
MD5 8c5ff7b459947985af05f3b7c4eb149b
SHA1 bdf924e93e8e1b62acacb1be9568e044475e7fea
SHA512 a575ad95ac4166ea6a24094b5fd057b925bded3e1d31b378f0b039226e46e5cfd023d4a73197f9f67e56e5df0889b67af9589d9675cc2f135e1066b7dd608901
TLSH
T146718D350D310F42EBD402BF24E3F210757A85D4FA131E79C920AB3E2B1C79802ABC46
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe586b19.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe586b19.TMP
Size 3KB
SHA256 cf5285eeb410344f408166cab7e673283ca5d7642eb135a91607890bff0f4859
MD5 f12cc630007e2437565f801d3769c330
SHA1 e3a170816f1c16ef398ae4b1407514aea49e96cc
SHA512 84dd167913654eaeda436d0a68b2c990562a06a779ea7561bc5ec29e502932fa17d3fcf8fceec284189c09e8d8955d03084e4a76feeb3548f4d631c6f9edd7f9
TLSH
T107717C350D314F42EBD402BF64E3F21071BA85D8FA131E79C9606B3E2B1C79802ABC56
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

HubApps

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\HubApps
Size 106KB
SHA256 eb2fd7422436fff93f6be09df3294b26cdb7afd18e6aa94dcdc0f208db78b2ed
MD5 25dca813dd764f2197142ef84bc5ce66
SHA1 8d6aefb01ee9f6d1fb0cfd89326cfe35af53a53d
SHA512 a9c8cd547c874b7b69cbb3a0c8214f43837911e522db768dcd075d23d05acfd7122cf2bcad281ea745025e4fb67cc9061b79f9dc1288ac1a113bd0d961841d43
SSDEEP 1536:IfEEtnH74ohBGZqW3iPPDuVvpBI/SvtZsA62UYPq:BuHSRhPjU1
TLSH
T154B35226D6A54C6B01F16264EC794382F325436F9282A82F3B7C5D5C2FBD93A6502F7C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 1KB
SHA256 06f3cb196652bb860ff9dc08ad48ae9900e8d3fb4b50ad8cc5c228642aad1d95
MD5 a9f9637f43f35ab093c3cfc13d24bb3e
SHA1 015114c0e9c0b0160d75fd8188f93a7af82c6eb9
SHA512 65392f5118e42fcd4755a8357b67fc7a68affadba0ef4e33d48f02d806cb71f348272b8fd1387508dd5d0c255bdc3604da34f721851f5ed16d876542e46723c7
TLSH
T110318EB7C3E487BD891156F09E247D1BCE1D0506422C3C5689F4AF1BA3E24B1E10165F
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 c0362691fb6df01c52058167736cc92c402dc0eb9bd75ffcb966fa55d18aed04
MD5 0bdff6e6710ba672a9307f152c864c13
SHA1 1e8e6a3bbb6a33d8256d4d02c927ccb87b67b1e0
SHA512 1dae784c6e2163d75e7c7da746f16a6201aae42c59d8fe41e6b8e4bfa01d76d8fc260498946ec0c663d22634cd2bc160e74cc3c4fc103c3b388d105968a1bbb5
SSDEEP 192:sxZYR3yM/jK1Ml8Mk1/ftsg9ZYIdpd+HW6+WNGYCkyrlaIgrJ:sxZYVM1/ftsg9ZpQHbGjA9
TLSH
T19D42E9127A34597BCCDBD209FA51BF53D6F94472A2940D48AAFCDA0C04E6EED220781F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 43aaa1263f90a5e6db4011e90fd8035f9ca4ee58de9e70df879d62a616b1c88e
MD5 f9930a2ca4498694607ba8e6dac65efc
SHA1 6e6515ac370c398b06ff9a2edf50d4bc091589cc
SHA512 36aa631f428a0bf75233aab7880e4ee00f385d7e5ef32c8da4422f19b29e72b2e7cc53cfcc549a6a3b3b0943301ff67417780f49f77e4d1673c9c86b47a33e03
SSDEEP 192:sxZYR3yM/jK1Ml8UQDk1/ftsP9YYIdpH+HW6+WNGYCQvrlaIg50J:sxZYVqo1/ftsP9YpeHbGCAG
TLSH
T11152D8127A34597BCCDBD609F941BF53D6F55472A2900D48AAFCDB0C04E6AED220782F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 30KB
SHA256 8b31ad9bbb0a3ee9d43a95ed456949f3538d809e39941d4607be4cf582aee64e
MD5 b54859f6f296fb2f67ecef84809f4769
SHA1 4111b7380f40e60c0a9c40096750cef1235e203e
SHA512 43992f991cd9368ca7a34de08469d165ce390f73faed0495827d49d1ae1af6a390f972faf4da443ce797e2b0703943fb8020daf7a8606bb73febe1b91d7c1422
SSDEEP 768:It8bqn+WvSCt68F1+UoAYDCx9Tuqh0VfUC9xbog/OVnZLlRTKVrroK:It8bqn+WvSCt6u1jaCZLbWVYK
TLSH
T1ACD20B3B280CCB7E4F845E5DEC26AF962DD801CB67988D4447FA894C03C76EA512B5DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 d06b4dfa96c708461c072e9e27b4234aba07dfdf3f348c2cb33102c1bff4846c
MD5 a39092e474a6c3e71aa31e07624e1e4c
SHA1 480b622e8a1bde8e53bc32a3f99b6f74dcdb8896
SHA512 3b9499876bda261bed20dd81094839ae680f525a84911edf223ada0a743d1fd4051189c9051bf23461d0512987e0adcd6dbee4e7493939873c1e26a63c449c5f
SSDEEP 96:KcOUKnqCKAwKxqmhZsLfZb7xG/2sEnxK84E5xoBJeno:invrhZsLfZb7o/2Ln94E5OBJeno
TLSH
T176916602713B238138FE2908925385768E4672633814A46F7FF958A60E7AF525EFDCDD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig~RFe5907b7.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig~RFe5907b7.TMP
Size 3KB
SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
MD5 904e6e94a1d46374c8630cfd86cc729f
SHA1 e1d9c3f7813878acc6510d48d95b2bf48b2e1a0d
SHA512 081e2a26252860ff8d8f7a9d0378ae56f0cc50574d13d2a121afdf74284963747ef874a4d73b1df7774cd8570972f4f513eefe0a0325fd088556d5b1ba946712
TLSH
T1DB815C4FCC0CBE77ABAB6A719A35D6B2F79131EA94518A977F8C444EE3050ED0242E50
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 66ace5949a1b2adb8ab66ffc8c815996c0725664343b3e3bbae394b11fd95bc7
MD5 9ded631cc7b10c8b57d9d0c1f173d380
SHA1 b0f1670117ca47fc82fbcf01074e81a984943559
SHA512 5df775297e161abb79e52f4677dfac549cb00345bf74d4820d65d16c965c57b9c09db24cef70f0c7c982b1b42e66beff01b4fb0a26f97617ff0f63c3497d2687
SSDEEP 192:vONm6Db6QmiUyLjHBa+j9OmaftmH+Rgg6U6:vONm6uaHBa+5OHfalzU6
TLSH
T1F102F935693C6CB79EB26E49F4873B275F94106BDA552F84D6D81F0C00D765C2307826
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 22KB
SHA256 dbc11559adf2e2541012f18bebae42d64832a275c9f3afc31c0d99334c30fea7
MD5 bc8f3e0614fd3e47f4405618f665903f
SHA1 364489b1257e21d5412d8dc55ec19b01a8d24438
SHA512 9ef57acfff674661876cb33ad22c375e7a0d5b92c5b3939ab720e4053dc30bfd3e20bfb3ea78c8e480f15290ed3688965cf1813bc1f5a9b2d179b9c4c3c05b79
SSDEEP 384:fiF1tNn/s3n9SQzsN78TUNTUlIlXSmoCFaI4Ea+5OHfaXFjwr82MbdbJ9ix9L:qF1j+9jSwgnoVIbaYOH89wrixivL
TLSH
T107A27C336964DC3B6EF68F88F54A36175EB490A7C585BA84E6D8AF0C01C76EC134BC19
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 19KB
SHA256 426e03913e1786cfe3b643d4d6167d8eb6611a813a994d36adcf17b61dfb021d
MD5 e2d094752ad8af84f838e18a6f6ce99c
SHA1 c1945109e936c3a309ce4709df73bd466f7b9a01
SHA512 096bf4800718e3ec9d48d239213e247b198b787f9c5822cf5b0cbbdbe064509b344630ee779e39780ddaaac5503414376512b4cf04328c12f92bf83b782c5d72
SSDEEP 384:3tNn/s3n9SfsNZ+SmoCFaI4Ea+5OHfaXFjbr82MbdbJ9ix9L:3j+9UtoVIbaYOH89brixivL
TLSH
T163928D327934AC371DE29688F44B3A175EB491A796892E84D5ED7F0D01CB6FC134BC1A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 19KB
SHA256 a6707e1251eb74b0c8ad7fe57f158cbe1caab58aa20031453a866290a14c80da
MD5 ba2ec4c50b786725dfcd44aa1e7a643a
SHA1 9bd39ef8611cfaf69742131a4a4facc938767e91
SHA512 19486bc4cfa8798c54f3497e7f992569776ef92dcab4775cb9a5fa117345467016b9e3ea7bc1789d1c4487cd0f4e0559e1b97bcc9ae1493c98cb1a91298d86db
SSDEEP 384:DtNn/s3n9SfsNZXSmoCFaI4Ea+5OHfaXFjbr82MbdbJ9ix9L:Dj+9UOoVIbaYOH89brixivL
TLSH
T170928D327934AC3B1DE2D688F44B3A175EB4916796892E84D5ED7F0D01CB6EC130BD1A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 8cdd6185a85152b2af824f8a0a081471945534ddfdc35b65d3dc1effaec9d1f8
MD5 5a05bbaf17f31b93e78a97be1da2fa20
SHA1 f0d86df1fdae13276cc243534291dcaed00dcfa4
SHA512 7ecfa2be40833abedb160036fd08b2b6ba088e804d4b72466cb0b01dded53fe0763c42f33852016889c1e0312854af92c6ffbd5a563d823ec6537cc2ee4993cd
SSDEEP 192:6ONM6DbyQmiUyxjbBa+j9OmaftmHXFgELNzyq7U6:6ONM6W2bBa+5OHfaXFjFrU6
TLSH
T14C12193278789C775EE2AA84F48736175EA44167DA4A7FC1D5C82F0C01DBAAC230EC26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

b1eb020b-7b38-46fe-bfe9-0e420e68d1d4.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\b1eb020b-7b38-46fe-bfe9-0e420e68d1d4.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 840ed7501cfc41e7b0fcaa15a73a07f9f8ec6fe9f01ac66af128dba7a3de9bbd
MD5 fefe64fef478a1928ba220b8cdd755f8
SHA1 d3508e848c620f056ab5d07b8797b182521583e9
SHA512 137d4407a681d8f1353c449e3110fd0be2e102b0ce6073a7a447dcdfed72f284fba04bd12c9d8cf682353fae0f5f0942fe50b8a82c66b42be3e68b8e519742a5
TLSH
T16641F39CB6E91148B3B66F5AABF6A96E487FBD372E06D49D00010D4F0A66B40C871737
MD5 SHA1 SHA512 TLSH

Submit Download