hxxp://g[.]3gl[.]net/jp/713/v3[.]3[.]4/M

Analysis

user interaction
yes
max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
23/06/2026, 17:48

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
http://g.3gl.net/jp/713/v3.3.4/M
Sample260623-wdevtsez5t

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
400	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134267104961921859"	msedge.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-889581200-2041691093-2048517887-1000\{EDA7283D-136B-4C52-BB29-1E07F73049A2}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4728	msedge.exe
4728	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
4752	msedge.exe
4752	msedge.exe
4752	msedge.exe
4752	msedge.exe
4752	msedge.exe
4752	msedge.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
4752	msedge.exe
4752	msedge.exe
4752	msedge.exe
4752	msedge.exe
4752	msedge.exe
4752	msedge.exe
4752	msedge.exe
4752	msedge.exe
4752	msedge.exe
4752	msedge.exe
4752	msedge.exe
4752	msedge.exe
4752	msedge.exe
4752	msedge.exe
4752	msedge.exe
4752	msedge.exe
4752	msedge.exe
4752	msedge.exe
4752	msedge.exe
4752	msedge.exe
4752	msedge.exe
4752	msedge.exe
4752	msedge.exe
4752	msedge.exe
4752	msedge.exe
4752	msedge.exe
4752	msedge.exe
4752	msedge.exe
4752	msedge.exe
4752	msedge.exe
4752	msedge.exe
4752	msedge.exe
4752	msedge.exe
4752	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
4752	msedge.exe
4752	msedge.exe
4752	msedge.exe
4752	msedge.exe
4752	msedge.exe
4752	msedge.exe
4752	msedge.exe
4752	msedge.exe
4752	msedge.exe
4752	msedge.exe
4752	msedge.exe
4752	msedge.exe
4752	msedge.exe
4752	msedge.exe
4752	msedge.exe
4752	msedge.exe
4752	msedge.exe
4752	msedge.exe
4752	msedge.exe
4752	msedge.exe
4752	msedge.exe
4752	msedge.exe
4752	msedge.exe
4752	msedge.exe
4752	msedge.exe
4752	msedge.exe
4752	msedge.exe
4752	msedge.exe
4752	msedge.exe
4752	msedge.exe
4752	msedge.exe
4752	msedge.exe

Suspicious use of WriteProcessMemory 33 IoCs

description	pid	Process	procid_target
PID 4752 wrote to memory of 2524	4752	msedge.exe	86
PID 4752 wrote to memory of 3036	4752	msedge.exe	88
PID 4752 wrote to memory of 400	4752	msedge.exe	89
PID 4752 wrote to memory of 3036	4752	msedge.exe	88
PID 4752 wrote to memory of 3036	4752	msedge.exe	88
PID 4752 wrote to memory of 1932	4752	msedge.exe	90
PID 4752 wrote to memory of 1932	4752	msedge.exe	90
PID 4752 wrote to memory of 3732	4752	msedge.exe	91
PID 4752 wrote to memory of 3732	4752	msedge.exe	91
PID 4752 wrote to memory of 3732	4752	msedge.exe	91
PID 4752 wrote to memory of 3996	4752	msedge.exe	92
PID 4752 wrote to memory of 3996	4752	msedge.exe	92
PID 4752 wrote to memory of 3996	4752	msedge.exe	92
PID 4752 wrote to memory of 116	4752	msedge.exe	93
PID 4752 wrote to memory of 116	4752	msedge.exe	93
PID 4752 wrote to memory of 116	4752	msedge.exe	93
PID 4752 wrote to memory of 1232	4752	msedge.exe	94
PID 4752 wrote to memory of 1232	4752	msedge.exe	94
PID 4752 wrote to memory of 1232	4752	msedge.exe	94
PID 4752 wrote to memory of 2152	4752	msedge.exe	97
PID 4752 wrote to memory of 2152	4752	msedge.exe	97
PID 4752 wrote to memory of 2152	4752	msedge.exe	97
PID 4752 wrote to memory of 1976	4752	msedge.exe	102
PID 4752 wrote to memory of 1976	4752	msedge.exe	102
PID 4752 wrote to memory of 3688	4752	msedge.exe	103
PID 4752 wrote to memory of 3688	4752	msedge.exe	103
PID 4752 wrote to memory of 4672	4752	msedge.exe	105
PID 4752 wrote to memory of 3100	4752	msedge.exe	114
PID 4752 wrote to memory of 3380	4752	msedge.exe	115
PID 4752 wrote to memory of 456	4752	msedge.exe	116
PID 4752 wrote to memory of 640	4752	msedge.exe	118
PID 4752 wrote to memory of 640	4752	msedge.exe	118
PID 4752 wrote to memory of 4728	4752	msedge.exe	119

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument http://g.3gl.net/jp/713/v3.3.4/M
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4752
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x260,0x7ffa0844c188,0x7ffa0844c194,0x7ffa0844c1a0
  2⤵
  PID:2524
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1692,i,11990307045118821946,14672097222463167286,262144 --field-trial-handle=2380,i,5330474915990296528,12751266759571718861,262144 --variations-seed-version --mojo-platform-channel-handle=2376 /prefetch:2
  2⤵
  PID:3036
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1864,i,4000777941780657252,4426370019061046124,524288 --field-trial-handle=2380,i,5330474915990296528,12751266759571718861,262144 --variations-seed-version --mojo-platform-channel-handle=2748 /prefetch:3
  2⤵
  - System Time Discovery
  PID:400
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2292,i,10110264752215126177,10839060646142145101,524288 --field-trial-handle=2380,i,5330474915990296528,12751266759571718861,262144 --variations-seed-version --mojo-platform-channel-handle=2984 /prefetch:8
  2⤵
  PID:1932
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3404,i,15056350993391129741,2546911405520855885,2097152 --field-trial-handle=2380,i,5330474915990296528,12751266759571718861,262144 --variations-seed-version --mojo-platform-channel-handle=3412 /prefetch:1
  2⤵
  PID:3732
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3420,i,14289366119436197206,11567316054928845193,2097152 --field-trial-handle=2380,i,5330474915990296528,12751266759571718861,262144 --variations-seed-version --mojo-platform-channel-handle=3448 /prefetch:1
  2⤵
  PID:3996
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4088,i,588742539653642640,16931484858307396827,2097152 --field-trial-handle=2380,i,5330474915990296528,12751266759571718861,262144 --variations-seed-version --mojo-platform-channel-handle=4120 /prefetch:1
  2⤵
  PID:116
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4100,i,11862877212342685703,9073797783864868748,2097152 --field-trial-handle=2380,i,5330474915990296528,12751266759571718861,262144 --variations-seed-version --mojo-platform-channel-handle=4124 /prefetch:2
  2⤵
  PID:1232
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=3600,i,6748657605000275962,5473358324493835610,2097152 --field-trial-handle=2380,i,5330474915990296528,12751266759571718861,262144 --variations-seed-version --mojo-platform-channel-handle=3564 /prefetch:1
  2⤵
  PID:2152
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3428,i,4748226905568604501,17623175268464079469,524288 --field-trial-handle=2380,i,5330474915990296528,12751266759571718861,262144 --variations-seed-version --mojo-platform-channel-handle=3368 /prefetch:8
  2⤵
  PID:1976
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3448,i,15637333550034986084,14196377685931691759,524288 --field-trial-handle=2380,i,5330474915990296528,12751266759571718861,262144 --variations-seed-version --mojo-platform-channel-handle=3716 /prefetch:8
  2⤵
  PID:3688
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5760,i,5124100942768265618,7296095921364702850,524288 --field-trial-handle=2380,i,5330474915990296528,12751266759571718861,262144 --variations-seed-version --mojo-platform-channel-handle=5776 /prefetch:8
  2⤵
  PID:4132
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5760,i,5124100942768265618,7296095921364702850,524288 --field-trial-handle=2380,i,5330474915990296528,12751266759571718861,262144 --variations-seed-version --mojo-platform-channel-handle=5776 /prefetch:8
  2⤵
  PID:4672
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4416,i,8297677802638034415,3629582746711476817,524288 --field-trial-handle=2380,i,5330474915990296528,12751266759571718861,262144 --variations-seed-version --mojo-platform-channel-handle=4536 /prefetch:8
  2⤵
  PID:3100
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4420,i,13808117746360776422,4677484132938078182,524288 --field-trial-handle=2380,i,5330474915990296528,12751266759571718861,262144 --variations-seed-version --mojo-platform-channel-handle=4400 /prefetch:8
  2⤵
  PID:3380
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4404,i,13343357761437341347,14729618600409864941,524288 --field-trial-handle=2380,i,5330474915990296528,12751266759571718861,262144 --variations-seed-version --mojo-platform-channel-handle=4408 /prefetch:8
  2⤵
  PID:456
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5172,i,15182139695832989861,618364347167527400,524288 --field-trial-handle=2380,i,5330474915990296528,12751266759571718861,262144 --variations-seed-version --mojo-platform-channel-handle=3544 /prefetch:8
  2⤵
  PID:640
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=5980,i,1423840630632946593,11713083240448317435,262144 --field-trial-handle=2380,i,5330474915990296528,12751266759571718861,262144 --variations-seed-version --mojo-platform-channel-handle=756 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4728

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:1736

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

blocklist

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\blocklist
Size 105KB
SHA256 9420686d12b2cba6dc69896d607eadac629280a010e5358a4872ab9753f24ed7
MD5 8be6e81804d8b903ae07c11b2e53e3d9
SHA1 817c41cb00b05a8f2040323b93c6416b92dbc01b
SHA512 c2cfff48ebb312975aa2615d841d0badff185589ad3a3f5e8420c2ea0eb5dc0e5354d917cc43d57bec169a63d4fa21d66e91dc3e195592ece23d37fff7c04680
SSDEEP 1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P7R:fwUQC5VwBIiElEd2K57P7R
TLSH
T1CDB3B931457E36BF26E93EE828CF1511B84F3912624895D4ABE1FE2C4845E68633CEF4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CrashpadMetrics-active.pma

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\CrashpadMetrics-active.pma
Size 16KB
SHA256 fde3b41a5711362d7f3df7d71563d5eb6cc679bae7f80f74afcdf81dbc09eafd
MD5 3406d3b708dcef0116bffd8eaa181ad4
SHA1 3df64b48bff2b9d4160d900e91a7670046a24340
SHA512 d22d05c221bd19bc3b07e9a5ed722fbf8fbf75d695302fe8ec441d6d1e653bd63b3751a9608b344cc859feb79c5869aaeedd08bf846dc01a522b3a0dbb1637d9
SSDEEP 12:sUXhV0xosU8xCe+JKlkQuMRxCb8ZXfgYJ0IJpP0KLsyW1L7Fx6:fRqxosU8xWMk8xVZ4YWI30otWn
TLSH
T18F727886B34494FFC8C35A7189BE27902374F6DE5F02836B6A3A7A0E2E271C44F44220
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 9aeab2c92c5f26a8ca39382cf1bb4652de05a24b8d0a9ed661920c6197bf4c98
MD5 722151c3c2c9d1bf9273dad578c24b92
SHA1 8c73ee2f65f9c7a61550c77f0ff7f3b2e262dbdd
SHA512 2d701005e69967e2b1d86e637b7e1011658167d340aa89a1d8a3826c1a0cd883f9a6d2e8ff8530362b27f034273eb9c1e432fc1a63348092e3fcfc9ecd12dada
TLSH
T19ED012323A18644AE656A1F0A413CB411637516624535B21B215949D9AA80D562C6192
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 46246483d08868ff03d5f9bb48e547ca61f651c3e59a4138f5a5da74c69b3ae0
MD5 c70fc44a424269679b1300a5be3376a5
SHA1 6162f1576d71e2726435c2e688415ae394c1369f
SHA512 c7fe73655fb22ef9d6d3620fa11cc8586300f67f906224e15b5de9802f495a10b66f3fdb475a44e7ed7af1a7d84be1c87f05f52d39641755f33237ede51a6e35
TLSH
T1F9D012323A58684AE656A1F0A412CB411637516624539B21B215949D8AA80D562C6192
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 e89854abcba7cf3f1c5de769596864f528cd384495c3cdafe29edf8c14f6245f
MD5 867960f0678fccc0fb25d63cb126954e
SHA1 a1848818034c24ab20c68da69e5548b0b912ad93
SHA512 f1be108b44c525f99493efec92dace764cf50f9924721d64eb04de459b66d7208f9d3ae1fc3ba51d56a392dfc0d3dd33a66ce011dcabd9db2e1e71bae98fc00e
TLSH
T1BA614D3DC6624491F3B05238E0DF067239360FC9FC275E7A01E0EA7436E6B22C05288A
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe58c3b8.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe58c3b8.TMP
Size 3KB
SHA256 b583b55ed436224583f9d4a393928e5089d36d4b83a27c6fca8e5b9d69379b46
MD5 096728dae56cecdb0a2b254308d09e4d
SHA1 70699ea21cd52c14a9b4dd27ab0b500e74859845
SHA512 dd8e31397b1e1a1724ae76359fbad5e0b57059a0797d5cb9fb840015d5cbc07b4865a2596fa49fdd64c6896338f44278dc75e0f5317432bbdd90f3dad9d33ea2
TLSH
T109614C7DC69244E1F3B15238E0DF067279360EC9FC276E7611E0EA7436E7B62C05288A
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

HubApps

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\HubApps
Size 106KB
SHA256 eb2fd7422436fff93f6be09df3294b26cdb7afd18e6aa94dcdc0f208db78b2ed
MD5 25dca813dd764f2197142ef84bc5ce66
SHA1 8d6aefb01ee9f6d1fb0cfd89326cfe35af53a53d
SHA512 a9c8cd547c874b7b69cbb3a0c8214f43837911e522db768dcd075d23d05acfd7122cf2bcad281ea745025e4fb67cc9061b79f9dc1288ac1a113bd0d961841d43
SSDEEP 1536:IfEEtnH74ohBGZqW3iPPDuVvpBI/SvtZsA62UYPq:BuHSRhPjU1
TLSH
T154B35226D6A54C6B01F16264EC794382F325436F9282A82F3B7C5D5C2FBD93A6502F7C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 928B
SHA256 f2cdffa5f8f5550d74897a1b36a1de0a224c5e4722f472124945319e6e9fd263
MD5 80fb37447b015f898419b0795264f268
SHA1 6ba1f7ea556573acc5486443d02889180ef8961f
SHA512 f2968b05e9f5a620bc6589b36f8bbf6742e5d273fdee4992308178097904f4f85e6ac0e85e0d3a3abd501982d1026b92458a66d1a622536f150f6b8fbbe3e174
TLSH
T1F8119CB3C3E585BECA0156F06A24AE2BCE2D090243283C56C9D4EF5B93F2475E00245F
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 b67830f4ecd8425705425967065986c2ee4b06396efb4a0592c84ff1d0064a96
MD5 958d8c3153e82f91454b5729a7e02b96
SHA1 51fcc9f60e0eca9f50c1d3154f63ee7025325c0a
SHA512 94c55d554309f9bac6befb094abbff364f1e92157b7dc493d512a8341feac70b9cd9d5bc791a0e86f9d67d3a0a9edb81e354767dac4ebb87ecf847fe686de516
SSDEEP 192:sxZrRoyM/jK1Ml8MkH/f8sDw18HxeMdIdpINHW6+WNkhW/Y9ItVGHm+zIgrJ:sxZrCMH/f8sC8HxCMHbv/5i9
TLSH
T14E52E9126A389977CCCBD309FA55BB53D6F40572A2940E48A9FCCA1C04E6BED2217C1F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 83cbc4f32fb9ae5b299f1b00fee782e00b7579d6ffba09fa39c3329f74487273
MD5 2c0a165191cf29b46d38e9d2f7832ee5
SHA1 8e28cbe94d5f724382d859dedfb9a69cbe1ecccf
SHA512 f4846000cebdd9b6fb71866ed89df952668b5254d4fc2a8be8562cf3142cf2e26539ca3ae2e40d029436afa39117bcd69d700d0998dba5fa6df26b94baa374c0
SSDEEP 192:sxZrRoyM/jK1Ml8UQckH/f8syw18HMeMdIdpmNHW6+WNkhW/Y9IMV9Dm+zIg5wJ:sxZrCqnH/f8sf8HMCuHbv/Hiy
TLSH
T10052E9166A389977CCDBD209F955BB53D6F40572A2900E48A9FCCB1C04E6BED2217C1F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 30KB
SHA256 4a3a37e7ca67ee8177691f942b8e66992c5d05347d94422587fe1c5b8d83494e
MD5 3ab25ad6f189f6e792a741931e877e4b
SHA1 6165aee084ac1bb17cea85282deaa978f4bb13e4
SHA512 d1e521ca39e233650efd3a1ea8229af8fdcd6202d986fc09e15a40f2fa992b08dae17df1c72d09cc4779bba13b1c181be971b0e472a75b23d2761b19a947a466
SSDEEP 768:9acv21wWvu+Z+8F1+UoAYDCx9Tuqh0VfUC9xbog/OVjFLlwmWN2ro2g6Yp:9acv21wWvu+Z+u1jaeFLeRNN2a
TLSH
T1C0D21B2B280CCB7E0F841E9CED2AAF866DD801CB57988D5447FA494C03C77EB511B59B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 bbff3da4062d5b3b3c077beb1f6badfc51a900fd9a58415435eeaeae10bbfe45
MD5 09ea788fa43b3201c2acc3e063d46a47
SHA1 774bd1a91d729b0c7d7248357d037be70c08e483
SHA512 0fc34e7bce774abe603b3e4ea18391d36518b876e37fbc5049bef1ea2deabbed2d1b372f39c81e456be238849649fedac8858a8e4a998067e2f49a453124960f
SSDEEP 96:KaRklRnHnqlPKZThqKLfTzqHxJSrBDauoKf6yauIKXK1:mT3/Xu
TLSH
T1B1910F06303B02E2787E6858A39385365E4139A77819F56F7BBC50A14F2BE211EFD4ED
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig~RFe5960b4.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig~RFe5960b4.TMP
Size 3KB
SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
MD5 904e6e94a1d46374c8630cfd86cc729f
SHA1 e1d9c3f7813878acc6510d48d95b2bf48b2e1a0d
SHA512 081e2a26252860ff8d8f7a9d0378ae56f0cc50574d13d2a121afdf74284963747ef874a4d73b1df7774cd8570972f4f513eefe0a0325fd088556d5b1ba946712
TLSH
T1DB815C4FCC0CBE77ABAB6A719A35D6B2F79131EA94518A977F8C444EE3050ED0242E50
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 11KB
SHA256 b25a45ade43179d81e935e12dfe88c18f4fd248f66eb1211a66cdbbcb03b6c91
MD5 79d0b1e4f1e6c8e5938b3b26acd7b6dc
SHA1 aca690a32e2bd14311d5532d209a1b702a125c59
SHA512 2e4fadfa72920e6cfae8e63ea1641a2caf45616f8b479f93a3cb02e799c67d1e6c302cd4cf0329baad64df130e93e5d04ef3af88b55ae213b95f9f6e86148871
SSDEEP 192:ukzLsNU9UuMQLE2D+YLecKdQmiU1kiz4e+CGU+Fdes9oveDSJrUlJioqbFU8:1sNQUL+DziFbJ8e+COdPeTJr7xFU8
TLSH
T15C32193269785C6B4AE3A580F44B36139FA45567DB893F84E5EC5F0C01DF6DC230A91A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 27KB
SHA256 8da5c0153facac25c0572d84d0c4b52f0a748835ff24ae3653be0de64db0510e
MD5 985a31567676f0158d111a775296565e
SHA1 ef7c734f4dde2dcb6d54b07eb3d10fc50a33f3ec
SHA512 b15b0fb5a28c69c2134f5ccbc0707711d5eefecf07b672925a87fb1bd9bafc5e9730b059d80123fc77100d752345226157ddfca657d89be0b9386b0598f3da05
SSDEEP 384:iiF1tNn/s3n9SmzsNx8TUNTUlIlU+DziFbb8e+COdPeTJrkxFRBhffvOzxxlHGxI:pF1j+9hUwgtcX2cThkxF7pqDGvu
TLSH
T15FC208F258D75936D9AE5743B73E2D064EBCC1A3B9852A54B3D85A0CCC8A1BFC306905
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 b1dfe6ec8f163c6c701ae95a2629cf1503d232e51b2740188fde4aef4c50ee68
MD5 2dfad062afa5ea0d89da14bfb810c674
SHA1 5855f27ed58bbbeff75b977f50f5a0a507f06a6c
SHA512 b4bb9d494dcb398a825ecb3f76fa81b4479fedb68b09969d7f4af272240be18b9b977f90f3ab250a23130b057ee0d26ae5a526f21edff6e05a72bda906358443
SSDEEP 192:JONVm6v+YLNQmiUynCZh+CGU+Fdes9ovtusPEU6:JONI6vz/jZh+COdPeFMU6
TLSH
T12B02E8356C382C6B9FF26E46F4873A275FA82177E9923F84D9E81F1C01D765C2306826
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 19KB
SHA256 d9799b3ad29d8fab1a9f119a4b470d3ddb2ea791080f9309a99826b55e1a3cce
MD5 6346d3ffa4d79346e268c0edc039ebdd
SHA1 c3618fbce850f22ae7d3a009a81306d7b609ea09
SHA512 6d274843ff193838f6361d34f71cfd1802e1523c7498e5697844d9b250d15ba2c195be8ef72a35aeb43d9fdf6eec73b67f9831658c73e9db33c2acec84beab5b
SSDEEP 384:qtNn/s3n9SfsNQUU+DziFbJ8e+COdPeTJr7xFRBhffvOzxxlHGx9u:qj+9UcCX2cTh7xF7pqDGvu
TLSH
T196927D3169286D270EE26584F44B361B5FF895B3AAC53F54E5ECAF0D01CF2D8131BA09
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 324a5e3611cb28a997d782ca38ee05af41fc6b6dd7d5d5d4cabefeba9a92b9d7
MD5 3ef0c42941576e658c817256f53a8fb9
SHA1 faf164dc5b224387d0c4d9a8c123997001cf25f4
SHA512 fae1cd0a6ae16e9347a3e7c63441d15bbf95b47cf56eb954639e2fc429038d7a6423a1f389cf168c9c15e5a0c848836ea8b402e9b282adc15f25abf2fc1aec5f
SSDEEP 192:eJONAr6v+YLBQmiUycCsh+CGU+Fdes9oveDSJrjCHoqbFU6:UONS6vzzGsh+COdPeTJrwxFU6
TLSH
T106122B3268785C6B5ED27941F48735179EE85177EA8A3F84E5EC2F1C01DF69C230A826
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

3982307b-4441-48a4-aeaa-3f2c2f36f9d4.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\3982307b-4441-48a4-aeaa-3f2c2f36f9d4.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 cdad2291ee5024418636aafb7cb17397c01a5b5231068aa2790f4417a8125834
MD5 0c75d03d61c3ba70f5559e737048b1a2
SHA1 dce61b5839756995af255c944e139a89265af65c
SHA512 c6f475c0417161d8d719dc89e9f3f6c0420b835c188426fbecf7b15e1f789072adb6545cf04e44116c44935210ebcfe64b006412761744c7fb821bc387d7215b
TLSH
T12E412D98A6F91148B3B36F5A5BF6A46E487FB9772F06C46E10110D4F0662B40CDB1B37
MD5 SHA1 SHA512 TLSH

Submit Download