hxxps://example[.]com

Analysis

user interaction
yes
max time kernel
900s
max time network
726s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
09/07/2026, 03:53

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://example.com
Sample260709-ef2zpsdt21

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
2212	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Gathers network information 2 TTPs 1 IoCs

Uses commandline utility to view network configuration.

System Information Discovery

T1082

Command and Scripting Interpreter

T1059

pid	Process
1372	ipconfig.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134280428547688307"	msedge.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-3053180483-1881419501-3594244048-1000\{138326FC-4C19-4773-9251-59B415A86690}	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2484	msedge.exe
2484	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 3 IoCs

pid	Process
4572	msedge.exe
4572	msedge.exe
4572	msedge.exe

Suspicious use of FindShellTrayWindow 33 IoCs

pid	Process
4572	msedge.exe
4572	msedge.exe
4572	msedge.exe
4572	msedge.exe
4572	msedge.exe
4572	msedge.exe
4572	msedge.exe
4572	msedge.exe
4572	msedge.exe
4572	msedge.exe
4572	msedge.exe
4572	msedge.exe
4572	msedge.exe
4572	msedge.exe
4572	msedge.exe
4572	msedge.exe
4572	msedge.exe
4572	msedge.exe
4572	msedge.exe
4572	msedge.exe
4572	msedge.exe
4572	msedge.exe
4572	msedge.exe
4572	msedge.exe
4572	msedge.exe
4572	msedge.exe
4572	msedge.exe
4572	msedge.exe
4572	msedge.exe
4572	msedge.exe
4572	msedge.exe
4572	msedge.exe
4572	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
4572	msedge.exe
4572	msedge.exe
4572	msedge.exe
4572	msedge.exe
4572	msedge.exe
4572	msedge.exe
4572	msedge.exe
4572	msedge.exe
4572	msedge.exe
4572	msedge.exe
4572	msedge.exe
4572	msedge.exe
4572	msedge.exe
4572	msedge.exe
4572	msedge.exe
4572	msedge.exe
4572	msedge.exe
4572	msedge.exe
4572	msedge.exe
4572	msedge.exe
4572	msedge.exe
4572	msedge.exe
4572	msedge.exe
4572	msedge.exe
4572	msedge.exe
4572	msedge.exe
4572	msedge.exe
4572	msedge.exe
4572	msedge.exe
4572	msedge.exe
4572	msedge.exe
4572	msedge.exe

Suspicious use of WriteProcessMemory 33 IoCs

description	pid	Process	procid_target
PID 4572 wrote to memory of 4700	4572	msedge.exe	86
PID 4572 wrote to memory of 2492	4572	msedge.exe	87
PID 4572 wrote to memory of 2212	4572	msedge.exe	88
PID 4572 wrote to memory of 2492	4572	msedge.exe	87
PID 4572 wrote to memory of 2492	4572	msedge.exe	87
PID 4572 wrote to memory of 1856	4572	msedge.exe	89
PID 4572 wrote to memory of 1856	4572	msedge.exe	89
PID 4572 wrote to memory of 4396	4572	msedge.exe	91
PID 4572 wrote to memory of 4396	4572	msedge.exe	91
PID 4572 wrote to memory of 4396	4572	msedge.exe	91
PID 4572 wrote to memory of 1864	4572	msedge.exe	92
PID 4572 wrote to memory of 1864	4572	msedge.exe	92
PID 4572 wrote to memory of 1864	4572	msedge.exe	92
PID 4572 wrote to memory of 5688	4572	msedge.exe	95
PID 4572 wrote to memory of 5688	4572	msedge.exe	95
PID 4572 wrote to memory of 2592	4572	msedge.exe	96
PID 4572 wrote to memory of 2592	4572	msedge.exe	96
PID 4572 wrote to memory of 3452	4572	msedge.exe	98
PID 4352 wrote to memory of 1372	4352	cmd.exe	114
PID 4572 wrote to memory of 3808	4572	msedge.exe	121
PID 4572 wrote to memory of 5892	4572	msedge.exe	122
PID 4572 wrote to memory of 4828	4572	msedge.exe	123
PID 4572 wrote to memory of 3304	4572	msedge.exe	125
PID 4572 wrote to memory of 3304	4572	msedge.exe	125
PID 4572 wrote to memory of 2484	4572	msedge.exe	127
PID 4572 wrote to memory of 3656	4572	msedge.exe	128
PID 4572 wrote to memory of 3656	4572	msedge.exe	128
PID 4572 wrote to memory of 2248	4572	msedge.exe	129
PID 4572 wrote to memory of 2248	4572	msedge.exe	129
PID 4572 wrote to memory of 4552	4572	msedge.exe	130
PID 4572 wrote to memory of 4552	4572	msedge.exe	130
PID 4572 wrote to memory of 6024	4572	msedge.exe	133
PID 4572 wrote to memory of 6024	4572	msedge.exe	133

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://example.com
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4572
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x23c,0x240,0x244,0x238,0x264,0x7ffaa0d2c188,0x7ffaa0d2c194,0x7ffaa0d2c1a0
  2⤵
  PID:4700
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1668,i,705526915263965542,10993376996018999699,262144 --field-trial-handle=2600,i,188437166669508657,6094173878098974841,262144 --variations-seed-version --mojo-platform-channel-handle=2584 /prefetch:2
  2⤵
  PID:2492
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1828,i,16077025335604062771,6446854417536410238,524288 --field-trial-handle=2600,i,188437166669508657,6094173878098974841,262144 --variations-seed-version --mojo-platform-channel-handle=2628 /prefetch:3
  2⤵
  - System Time Discovery
  PID:2212
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2304,i,16890466872926589429,13711669988884769296,524288 --field-trial-handle=2600,i,188437166669508657,6094173878098974841,262144 --variations-seed-version --mojo-platform-channel-handle=2676 /prefetch:8
  2⤵
  PID:1856
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3484,i,11978046725481842368,9426276636511569520,2097152 --field-trial-handle=2600,i,188437166669508657,6094173878098974841,262144 --variations-seed-version --mojo-platform-channel-handle=3516 /prefetch:1
  2⤵
  PID:4396
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3488,i,8006336574792695821,10579649936187609991,2097152 --field-trial-handle=2600,i,188437166669508657,6094173878098974841,262144 --variations-seed-version --mojo-platform-channel-handle=3520 /prefetch:1
  2⤵
  PID:1864
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4984,i,15112413883571281658,10681745797982726131,524288 --field-trial-handle=2600,i,188437166669508657,6094173878098974841,262144 --variations-seed-version --mojo-platform-channel-handle=5024 /prefetch:8
  2⤵
  PID:5688
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4996,i,9627523502452408510,14927639047729828087,524288 --field-trial-handle=2600,i,188437166669508657,6094173878098974841,262144 --variations-seed-version --mojo-platform-channel-handle=5032 /prefetch:8
  2⤵
  PID:2592
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5800,i,14117669877113758604,9071577406992283649,524288 --field-trial-handle=2600,i,188437166669508657,6094173878098974841,262144 --variations-seed-version --mojo-platform-channel-handle=5816 /prefetch:8
  2⤵
  PID:1548
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5800,i,14117669877113758604,9071577406992283649,524288 --field-trial-handle=2600,i,188437166669508657,6094173878098974841,262144 --variations-seed-version --mojo-platform-channel-handle=5816 /prefetch:8
  2⤵
  PID:3452
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5844,i,8335733925940829736,9115030154443466451,524288 --field-trial-handle=2600,i,188437166669508657,6094173878098974841,262144 --variations-seed-version --mojo-platform-channel-handle=6072 /prefetch:8
  2⤵
  PID:3808
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5780,i,8756922661509799706,4900313439254984683,524288 --field-trial-handle=2600,i,188437166669508657,6094173878098974841,262144 --variations-seed-version --mojo-platform-channel-handle=6012 /prefetch:8
  2⤵
  PID:5892
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5820,i,14419051225809670467,12035159488219240478,524288 --field-trial-handle=2600,i,188437166669508657,6094173878098974841,262144 --variations-seed-version --mojo-platform-channel-handle=6160 /prefetch:8
  2⤵
  PID:4828
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4992,i,17343321567147789432,17775567283248831728,524288 --field-trial-handle=2600,i,188437166669508657,6094173878098974841,262144 --variations-seed-version --mojo-platform-channel-handle=5128 /prefetch:8
  2⤵
  PID:3304
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6136,i,8440760321792990471,6554049793556727239,262144 --field-trial-handle=2600,i,188437166669508657,6094173878098974841,262144 --variations-seed-version --mojo-platform-channel-handle=6140 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2484
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5728,i,1294175785211443659,12244954052957218294,524288 --field-trial-handle=2600,i,188437166669508657,6094173878098974841,262144 --variations-seed-version --mojo-platform-channel-handle=4052 /prefetch:8
  2⤵
  PID:3656
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4624,i,16916544980312270853,5107766453933198798,524288 --field-trial-handle=2600,i,188437166669508657,6094173878098974841,262144 --variations-seed-version --mojo-platform-channel-handle=3244 /prefetch:8
  2⤵
  PID:2248
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_xpay_wallet.mojom.EdgeXPayWalletService --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5396,i,13387268336568441490,15991003065013874853,524288 --field-trial-handle=2600,i,188437166669508657,6094173878098974841,262144 --variations-seed-version --mojo-platform-channel-handle=4984 /prefetch:8
  2⤵
  PID:4552
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4624,i,11354541624654888848,8530100651838485423,524288 --field-trial-handle=2600,i,188437166669508657,6094173878098974841,262144 --variations-seed-version --mojo-platform-channel-handle=1032 /prefetch:8
  2⤵
  PID:6024

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:5516

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:5432

C:\Windows\system32\cmd.exe
"C:\Windows\system32\cmd.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4352
- C:\Windows\system32\ipconfig.exe
  ipconfig
  2⤵
  - Gathers network information
  PID:1372

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 9300dc4b11c647d4484e20f994dffbbd9939379d590fc7dedf9875372c431ce1
MD5 b031933009b03b3dcfc6f363760f83dd
SHA1 a9d3126d19c73dafd7e12a688bb3a802627790ee
SHA512 f606a12a9a0879bb3f7d6c9bcb6e3754434b9f0d8f1d351e8104aef087c326f689af5174eddcb6a3cd1f1d07864ff544fc76e73f8b76bf6d4330e19666cb7b28
TLSH
T18FD012BA2A4E7010F26D4A31B416CB00776D15A12852A705E22D944C99A90A562C62C6
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 8da58a9b03c676d64167caf3657c5315a0b78038e3ae23bfef432a40d8d22290
MD5 81f1d957977f2d73471366011b7128bf
SHA1 c3403bfa34ee45b494966cf8be9bed08da2c5168
SHA512 171afd7f20b750bc0bdc1fc9fd4cf14984e63031e562c60a7b1bab3112c84572ebc63669b744e0e5399b2f5453039fb86937cf7ab417a72da7f1ad931c88f0c5
TLSH
T152D012B62A4A7010F2694A31B456CB00776D15A12852A705E26D945C99A90A566C62C6
MD5 SHA1 SHA512 TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 334B
SHA256 f1ffcd9e3bc5fa87dcf063e6e0f83db8645255261a978f532fe12d526047fcac
MD5 56384bcf80c00255ff96f27a2ee8fa51
SHA1 7bd670f86939d84837cf0084d761d7bd742c7014
SHA512 b16a01f12a9e7dd0170b125793f5645796c2f8bbae86e820e599bf0590779cb4917fd50efbfe677fda0d6a945856df98d23d6dba77a9724d1320e8ba722c9b4d
TLSH
T10DE0788A17CCC25D91516647415C471C51D13E2ED3C5B9175710F478770104067DDDFC
MD5 SHA1 SHA512 TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 7KB
SHA256 f0b5840e87bf5b09f91c485670d143d2036afbd8e7a725f4b4fa86f6059c3101
MD5 875ec3859c527d385a0a3fb2a44e17bf
SHA1 9b63db6c75fcd5cc7e670a3a076a24a5f199f12f
SHA512 b3ccc980d7463e62822360f261ae4e7705f12415707b63899c38e7d88a3b9cc88de86d3c8eb07b2e8e298a64b95305c78f1de331eddceb8b74d6e88191df88a0
SSDEEP 192:ljc50Elt3fpGGsfsfsfJJJeeeLLLgggVVVsPsPsPDW7Nf7NfQASh:ljc50ElhpGGEEEJJJeeeLLLgggVVV88+
TLSH
T143F16047C7D8C7AA8B1510CA49A0676C10B13B0AEBDCD618135CF9ED364E49BEDF66E0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\MANIFEST-000001
Size 151B
SHA256 638fc7e45a745683ad16c83c4be835e65031503a39b5c456ce140c71d890910e
MD5 00a76bdd21b71faf50b8ecdd6027696f
SHA1 1e4e7650207c1941c05d1eda32fed3a6de831ad4
SHA512 263500319a5bd0ee03b7aa67af740ba8dfc0c9724a4ccff796526f04be4f699eccb58c2cd738fe74cb967c8096a9d5e6ac7d4ebc11dc1c72a2e721a58da4a4f2
TLSH
T1E3C08C7938DD681AEAA8287AA34AA0040FB042052022FC2642B8EE847A815A40A5A124
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BrowsingTopicsState
Size 414B
SHA256 d5c31728edf9a7bff36c6e9874659ef6732673f1fc4bf63dcd9fc3b6be9f9ca6
MD5 b159cd0be07fb02027e339c84e60e23a
SHA1 8f779744a858d4d099c6ce1ead6281c05abcdae7
SHA512 bbdf728910d773f92b096b4521c4f18204a2c49d8bd2fb59c268ccf255971c94619277f715ea2cbd4b3fc95cb4e9f15d2d4bc55347acaa62eca2e8a96684b617
TLSH
T1CEE022AADC32FC7758FD4B68B0198796E711131B2A40894F3B3C82088FB062A45C685C
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

HubApps

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\HubApps
Size 106KB
SHA256 eb2fd7422436fff93f6be09df3294b26cdb7afd18e6aa94dcdc0f208db78b2ed
MD5 25dca813dd764f2197142ef84bc5ce66
SHA1 8d6aefb01ee9f6d1fb0cfd89326cfe35af53a53d
SHA512 a9c8cd547c874b7b69cbb3a0c8214f43837911e522db768dcd075d23d05acfd7122cf2bcad281ea745025e4fb67cc9061b79f9dc1288ac1a113bd0d961841d43
SSDEEP 1536:IfEEtnH74ohBGZqW3iPPDuVvpBI/SvtZsA62UYPq:BuHSRhPjU1
TLSH
T154B35226D6A54C6B01F16264EC794382F325436F9282A82F3B7C5D5C2FBD93A6502F7C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 1KB
SHA256 a3c40c9a4e652948fa61185b99fc6437046b33ed457a32eee99730c0a1c3967b
MD5 465ec2851ba810b4fe02b82d648c3981
SHA1 632886527a957df023cfcef71227e002521d3403
SHA512 2e57bbb96cbdf6365af212f4ff3e40aedd365964ee8253c8f38d65b8f0248018cd610f7387315262e725990733a4de98976b9d0750509556e502386cb02a2326
TLSH
T143317CF783F4856E9A1196F0AA18BE2FCE2D0511432C7DAA85E4AE1793E3471E041A5B
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 1ab54cda6f6593bdfb7e6586ac5814dde805851f449026d19dc558b3d1ac7232
MD5 8719709a61cf6f1289b5eb74e4364d28
SHA1 ab8d064f400816917246fb43d157379c394101a0
SHA512 85a914a8c482b8261935763071fc4d61ef8d3521f5135daac9cc495fa12058a57f5ba28f5fd7f3421a630c8d249a33e5a595980db87eaa8e60523c198cb3c713
TLSH
T16041ADF783F4856EDA1196F0EA18BE2FCE1C0510431C3DAA85E4AE1793E2471E141A5B
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 15KB
SHA256 38b43b82802ff5e6e90c759825f5f0e8b0ec7d0d6248db190712cd3ee33ce39e
MD5 be142cc51a789986257bf2c7dc73147c
SHA1 6a00bdda58852c336cf4430b437dd28fa646682c
SHA512 8f9ec7759870daa6809f0793f3bbf91ca354a03d8fc6bd7ea566a98d15fe31db12dd7d9161f1b24747d557980ccac92c211f748466424b44e3b5df9fed429bdd
SSDEEP 192:sxZ7IR4yMqZjK1Ml8UQEyt/fVsrDoFZdOzodp8YHW6+WNBtF/Yvi8M0CIg5ZOJ:sxZ7IJqZt/fVsrkzVZHbp/l5Pa
TLSH
T1E062F9166A345977CCD7D219F645BB93D6F90163A2905E44AAFCCB0C05EBBEC220782F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 15KB
SHA256 545b23ad9df4b84649b2925122c731e3226543fa613754cf6e4dbc39f7b2f6a3
MD5 083c0bb9ebb419346b9ac40e3b096088
SHA1 fd1a1024471ae8bbc008b27c6c9f770bd9d5011a
SHA512 b1d8827a0c4b132d55d10121f57bb9c6ec50d3817fcda6efba27966f84c80cfd6865d78d7b8a7883a9e708c97d543488e0b8bb04836f1303551b56ec69359880
SSDEEP 192:sxZ7IR4yMqZjK1Ml8Myt/fVsscDoHaZdOzodp8YHW6+WNBtF/YvRu8U0CIgjOJ:sxZ7IJat/fVsscMazVZHbp/d5ja
TLSH
T11762F9166A34597BCCD7D209F645BF93D2F91163A2905E449AFCCA0C05E7BEC220781F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 30KB
SHA256 d3ed28410c95bcdd49b775e999633ec95a9fd79e43121075d441a0e078c22041
MD5 f69e750b13c549c16996bde771106f07
SHA1 f3ce7bce220e59cf4ead817ef6423038f0d78324
SHA512 f942c9f08562a4828ba0e5eddd4688fc3995511e90fac2e939ef5f22ba5105f580b294d4c4e56e3adef92b0304627a7501a96a18e13b795a929ffee8b420600b
SSDEEP 768:ZYsv8Od/hWvFvmX8F1+UoAYDCx9Tuqh0VfUC9xbog/OVA0LlEe9NsQroIRLO:eY8Od/hWvFvmXu1ja10Lm2NuIq
TLSH
T19BD20B3B680CCB7E4F840D9DEC2A6F966DD801CB66984D5447FA884C03C77EB521B59B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\cdf12dee-6673-4e91-954c-23b338c514e6\index-dir\the-real-index
Size 1KB
SHA256 3268e9a22da9f12a76c485d7509ada21a2eff83e6bdc1d8baf30720efa8b9449
MD5 a24afbaea615d2dcbfd07622b43f2dd0
SHA1 4bacb114a48706f3e5d1b9d698b1fd1245dd88db
SHA512 e2126d05e5705c6e356cafe6ab98b783232e5da5a279c1e7edfba47f8fe8ebf40a148293a354f1901e43d513619a5c08feb2edc788cd935ffccda75925017b3a
TLSH
T1CE41968D4D518A9FED9441B200B664A437B4DCCD2B1192178C7D333BBC6336F2A5B5AC
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5ceb23.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\cdf12dee-6673-4e91-954c-23b338c514e6\index-dir\the-real-index~RFe5ceb23.TMP
Size 1KB
SHA256 932839edfbcb63a3b6d9e47a331ce7de30ae7ee7463043f34023a988317e9b05
MD5 780f2daecf0326cc9dda84e01338510a
SHA1 4c74134a43c0f433945d83f22cce85d93a4c58b4
SHA512 e29a64f35a760b5a2b05f0102ce1e9f925384fe4f3364094a25b0dd503869453259af264d199ad31154f4ff7f7eca04f798ec6e0ae317b32a649dd2505f29c9c
TLSH
T19B41868A4E41451FD8D440720592A4A43379D80097127B47A4BC523A78B17BD2D4E1D8
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\index.txt
Size 371B
SHA256 5ba9397e1807d2e674b4d79e61c9318dc2ea612f3b85ab12e682aaeaf7e8b3db
MD5 7b69b4c0a1b8fc22a3807a7cb4820b6b
SHA1 308b452c03034d3beec6337abefc134042008f3f
SHA512 82efe909b68035961d91333d0bc77cd32bdc17621903dc358ae0a0c0630b50f9ae6bfcd6bbef0c84ea0c4ced321a57ee4efc79937d3d67a66f1f22874a5c8cd2
TLSH
T196E068B33EFB1850FC6B93C6203008A00005755498809D1F2816B28325A13192016CA6
MD5 SHA1 SHA512 TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 23KB
SHA256 143f1bffe685721661a37bf2f83e8cc82673524dae7985cb28c255256a03223a
MD5 caddafcf21152dded4af5ea8092eeba2
SHA1 72121feee6e4591f7dc9e642790c551b242965cd
SHA512 a8e5380003d16a8f25265233a2325c9af0986b058e6df755a4774ac4ab95492d5471e49a178c75b66ff80b23070ff79eacc09ef352d0b19fbf76fe17c9b34919
SSDEEP 192:05ppxnY753RNBvRJJdt7p5J9NpZFnwVRnlV0hOC:0LppY93PBZJPtN53NTl
TLSH
T138B2695A703A0211397E2988B39696364F4235A37058E4BF7FB814A54F67E224CFDCED
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 33KB
SHA256 6ebc90d2c055d84655d19681fe664cbcf47195857657245135328f90cfb23301
MD5 52b61737d579582acfae501e0a693e57
SHA1 f584911037f17daa61dc4a7979567d3bacf94f9f
SHA512 f5328bb9e711fbd0455d513c3dd06393411d81d0ee0811bacb5ff14a7b8d46fc710feb630dc04862be0dfcc02882120f80a103b4aeef4c947c216ea4242e22b7
SSDEEP 384:naiFotNn/s3n9SHC3sNS8TUNTUlI4vQckCrGra2phiftGNZO0saBkyriu2zOObjr:RFoj+9H3fwgekJaooGNElsiu2z29MD
TLSH
T1EEF2C2F698D78A73E89E4B97A37E2D469AFCC153B5881984B7C81D0CCD861BFC306815
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 28KB
SHA256 35a5c89b08bf305adcec055e921dce49de007a441382795be25c2a49fcb82910
MD5 46fecae4524bf3f26b0a1b0fa447e208
SHA1 b36383682fc5f3129bb7e0f18d6820f8c445bc6f
SHA512 194fad7e3a56c8acadb57872f5124b4013e75354c1cf416269b10c0c25e1cff4777254f232af6af4ae0002bb703cd2f5d3c5489ec4fdad594ca37c1e50515a8c
SSDEEP 384:nWiFotNn/s3n9Se3sNS8TUNTUlI4vQckCrGro2phiftGNZO0saBkyr6u2zOObjIE:9Foj+9P3fwgekJoooGNEls6u2z29MD
TLSH
T11ED23A36EC69CEB7EDE34FD9A24A3A47EEF042638A8C5AC4D9D91E5C01871DC430B815
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 25KB
SHA256 bb1d3b188536694c1036dec56c8c2eb4a8b898c16a5b02bc028233bd3ee8a39c
MD5 c5157f9d9f5c17d476105e0954c78b55
SHA1 b1f2b09312dcf6ceb8d4e002ad28fe1019f9e32c
SHA512 09007efaeb7afe34829861794a09d765e636cb69abc05e27ff44a75856bb84a74106f97b661b7243092067108f8d0ed38a6523cd7bec87cca1e3f2734ee48cd6
SSDEEP 768:pzFccps3vwgbkUCB5oGNElsku2zI8p0gH:Fs3Zsv0I8p0e
TLSH
T1BAC24B32EC68CEB7ECD34B99A74A3547DEE05227868C9AE4CADD1E5C00D71DD530B816
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 25KB
SHA256 2953fdc892d2df21277aed2f41a1978350975c31a0192362f837776239ec28a2
MD5 575501431eca21eb3195630098d7c4bb
SHA1 724c2c3121661938131dd6069f0ff76399d343d6
SHA512 48355724c8d183a43f40c54e2ae14c9e9d7018cb82190046034afe8fadf969fb4aa10822d2082cda603852642af581e18d3bad85120e48e4803f9b877ec015f1
SSDEEP 384:npziF9CcmyWCs3sNx8TUNTUlIm2QckCr9lBKphiftGNZO0saDDp6e4KV8p054HVt:peFccps38wgbkU/koGNEsgI8p0gH
TLSH
T1CBB26D36EC68CEB7ECE74F99B74A7A07DEE01227859C5AD4CAD81E1D00931DC530B826
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 28KB
SHA256 6e37eb9289abe0ac750adabae16801e08b2ebd7b9512d5e6bac65f7cd187ca47
MD5 6f8ac5a89d58c4974eb1a6460cf46877
SHA1 89d5116db46e61ae46d260fefb02e2936cfd1b5c
SHA512 dc34b14263fa4de57b24c1edc4e842b969d92bc8e6f38304c174f5fefd1adcc2976e11c080acacc057bb7771a8141726fd256cb0da0c658cb7ace4a192b48503
SSDEEP 384:npciF1tNn/s3n9S73sNS8TUNTUlI47QckCrgro2phiftGNZO0saBkyr6u2zOObjr:pHF1j+9+3fwgik/oooGNEls6u2z29MD
TLSH
T154D24A36E865CEB7EDE34FD9A64A3A47EEF04263868C5AC8D9D91E5C01C71DC430B815
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 28KB
SHA256 f008fc73e6a830dd56fa231627a503f809fd1580a3548a008f68e061d149cdc5
MD5 262ea664444c5a326105721af7cdf358
SHA1 821a0d5103be107dd5fef00902505a8e92c314bb
SHA512 c05ad1a56904ee40008ece3f429805c5e3d7196bdadc39d5de9de270fd427caf0db13bc291810bd1377d27fe836f7456b811d499895a94f756d7b04f32ee8248
SSDEEP 384:npciFotNn/s3n9Se3sNS8TUNTUlI4vQckCrGro2phiftGNZO0saBkyr6u2zOObjr:pHFoj+9P3fwgekJoooGNEls6u2z29MD
TLSH
T144D23A36E869CEB7EDE34BD9A24A3A47EEF042638A8C5AC4D9D91E5C01C71DC430B815
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 15716ddfbdbf3893c51bd11f2a30ec0ba8f7d9c577c5d7956e0a011eaf5f4ae6
MD5 a55a6309427e16a521f3b3f2bd9238a5
SHA1 097eba1a74a7b0bccb3b3b5c0fff2e518c5ef578
SHA512 fdfa56a7be3020f72b207c8df0d0b4e5af2065fb1c572d2efc23b09299c8f583d2baf39ce3e89314536dbf18539a2115e3960b0b0b57c1f82d6c0a44c762421b
TLSH
T19A41FA58AAFA1158B3B73E56ABF6A86D447FB8772F0BD45D10120D4E0A27E40C862737
MD5 SHA1 SHA512 TLSH

Submit Download

memory/3452-204-0x00000203CBCE0000-0x00000203CCCE0000-memory.dmp

Download