hxxp://adobeclickc[.]pages[.]dev

Analysis

geolocation tags

nanew-jerseynorth-americaunited-statesususa
user interaction
yes
max time kernel
149s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
11/07/2026, 10:42

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
http://adobeclickc.pages.dev
Sample260711-mrrbcaat3x

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
1192	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134282401511207473"	msedge.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-204488895-2999877624-296153668-1000\{2A2C2455-450D-443C-9DC4-DAE119E6B0F4}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
60	msedge.exe
60	msedge.exe

Suspicious behavior: LoadsDriver 4 IoCs

pid	Process
668	Process not Found
668	Process not Found
668	Process not Found
668	Process not Found

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 8 IoCs

pid	Process
1904	msedge.exe
1904	msedge.exe
1904	msedge.exe
1904	msedge.exe
1904	msedge.exe
1904	msedge.exe
1904	msedge.exe
1904	msedge.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
1904	msedge.exe
1904	msedge.exe
1904	msedge.exe
1904	msedge.exe
1904	msedge.exe
1904	msedge.exe
1904	msedge.exe
1904	msedge.exe
1904	msedge.exe
1904	msedge.exe
1904	msedge.exe
1904	msedge.exe
1904	msedge.exe
1904	msedge.exe
1904	msedge.exe
1904	msedge.exe
1904	msedge.exe
1904	msedge.exe
1904	msedge.exe
1904	msedge.exe
1904	msedge.exe
1904	msedge.exe
1904	msedge.exe
1904	msedge.exe
1904	msedge.exe
1904	msedge.exe
1904	msedge.exe
1904	msedge.exe
1904	msedge.exe
1904	msedge.exe
1904	msedge.exe
1904	msedge.exe
1904	msedge.exe
1904	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
1904	msedge.exe
1904	msedge.exe
1904	msedge.exe
1904	msedge.exe
1904	msedge.exe
1904	msedge.exe
1904	msedge.exe
1904	msedge.exe
1904	msedge.exe
1904	msedge.exe
1904	msedge.exe
1904	msedge.exe
1904	msedge.exe
1904	msedge.exe
1904	msedge.exe
1904	msedge.exe
1904	msedge.exe
1904	msedge.exe
1904	msedge.exe
1904	msedge.exe
1904	msedge.exe
1904	msedge.exe
1904	msedge.exe
1904	msedge.exe
1904	msedge.exe
1904	msedge.exe
1904	msedge.exe
1904	msedge.exe
1904	msedge.exe
1904	msedge.exe
1904	msedge.exe
1904	msedge.exe

Suspicious use of WriteProcessMemory 39 IoCs

description	pid	Process	procid_target
PID 1904 wrote to memory of 628	1904	msedge.exe	86
PID 1904 wrote to memory of 1192	1904	msedge.exe	87
PID 1904 wrote to memory of 3716	1904	msedge.exe	88
PID 1904 wrote to memory of 3716	1904	msedge.exe	88
PID 1904 wrote to memory of 3716	1904	msedge.exe	88
PID 1904 wrote to memory of 1812	1904	msedge.exe	89
PID 1904 wrote to memory of 1812	1904	msedge.exe	89
PID 1904 wrote to memory of 3352	1904	msedge.exe	91
PID 1904 wrote to memory of 3352	1904	msedge.exe	91
PID 1904 wrote to memory of 3352	1904	msedge.exe	91
PID 1904 wrote to memory of 5004	1904	msedge.exe	92
PID 1904 wrote to memory of 5004	1904	msedge.exe	92
PID 1904 wrote to memory of 5004	1904	msedge.exe	92
PID 1904 wrote to memory of 1008	1904	msedge.exe	93
PID 1904 wrote to memory of 1008	1904	msedge.exe	93
PID 1904 wrote to memory of 1008	1904	msedge.exe	93
PID 1904 wrote to memory of 1772	1904	msedge.exe	94
PID 1904 wrote to memory of 1772	1904	msedge.exe	94
PID 1904 wrote to memory of 1772	1904	msedge.exe	94
PID 1904 wrote to memory of 1060	1904	msedge.exe	97
PID 1904 wrote to memory of 1060	1904	msedge.exe	97
PID 1904 wrote to memory of 1060	1904	msedge.exe	97
PID 1904 wrote to memory of 2296	1904	msedge.exe	99
PID 1904 wrote to memory of 1604	1904	msedge.exe	100
PID 1904 wrote to memory of 2296	1904	msedge.exe	99
PID 1904 wrote to memory of 1604	1904	msedge.exe	100
PID 1904 wrote to memory of 5092	1904	msedge.exe	101
PID 1904 wrote to memory of 5092	1904	msedge.exe	101
PID 1904 wrote to memory of 5092	1904	msedge.exe	101
PID 1904 wrote to memory of 3908	1904	msedge.exe	103
PID 1904 wrote to memory of 636	1904	msedge.exe	104
PID 1904 wrote to memory of 636	1904	msedge.exe	104
PID 1904 wrote to memory of 636	1904	msedge.exe	104
PID 1904 wrote to memory of 4848	1904	msedge.exe	115
PID 1904 wrote to memory of 4448	1904	msedge.exe	116
PID 1904 wrote to memory of 4776	1904	msedge.exe	117
PID 1904 wrote to memory of 1144	1904	msedge.exe	119
PID 1904 wrote to memory of 1144	1904	msedge.exe	119
PID 1904 wrote to memory of 60	1904	msedge.exe	122

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument http://adobeclickc.pages.dev
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1904
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x258,0x7ffd9b02c188,0x7ffd9b02c194,0x7ffd9b02c1a0
  2⤵
  PID:628
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1964,i,2017147462739879019,10393037193110742510,524288 --field-trial-handle=2340,i,12344502483881049778,5925376463022877186,262144 --variations-seed-version --mojo-platform-channel-handle=2372 /prefetch:3
  2⤵
  - System Time Discovery
  PID:1192
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1800,i,6718156696965361042,5175611487808995100,262144 --field-trial-handle=2340,i,12344502483881049778,5925376463022877186,262144 --variations-seed-version --mojo-platform-channel-handle=2336 /prefetch:2
  2⤵
  PID:3716
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2460,i,15980381219496163426,2456497268977760469,524288 --field-trial-handle=2340,i,12344502483881049778,5925376463022877186,262144 --variations-seed-version --mojo-platform-channel-handle=2476 /prefetch:8
  2⤵
  PID:1812
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3448,i,915849445734282296,8185492443591828177,2097152 --field-trial-handle=2340,i,12344502483881049778,5925376463022877186,262144 --variations-seed-version --mojo-platform-channel-handle=3472 /prefetch:1
  2⤵
  PID:3352
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3452,i,12480330709405802515,11843725247714053050,2097152 --field-trial-handle=2340,i,12344502483881049778,5925376463022877186,262144 --variations-seed-version --mojo-platform-channel-handle=3492 /prefetch:1
  2⤵
  PID:5004
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4228,i,18092056120423221505,7588277821761763626,2097152 --field-trial-handle=2340,i,12344502483881049778,5925376463022877186,262144 --variations-seed-version --mojo-platform-channel-handle=4264 /prefetch:1
  2⤵
  PID:1008
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4240,i,1974608397681017170,10724416378389961820,2097152 --field-trial-handle=2340,i,12344502483881049778,5925376463022877186,262144 --variations-seed-version --mojo-platform-channel-handle=4296 /prefetch:2
  2⤵
  PID:1772
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=4632,i,1857345385794622139,12123924349070913176,2097152 --field-trial-handle=2340,i,12344502483881049778,5925376463022877186,262144 --variations-seed-version --mojo-platform-channel-handle=3580 /prefetch:1
  2⤵
  PID:1060
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5220,i,16045200408228998451,13321867241698771561,524288 --field-trial-handle=2340,i,12344502483881049778,5925376463022877186,262144 --variations-seed-version --mojo-platform-channel-handle=5320 /prefetch:8
  2⤵
  PID:2296
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5244,i,5078431749713942950,11882162972006218892,524288 --field-trial-handle=2340,i,12344502483881049778,5925376463022877186,262144 --variations-seed-version --mojo-platform-channel-handle=5312 /prefetch:8
  2⤵
  PID:1604
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --always-read-main-dll --metrics-shmem-handle=5940,i,9025745692561287477,17962225456896058355,2097152 --field-trial-handle=2340,i,12344502483881049778,5925376463022877186,262144 --variations-seed-version --mojo-platform-channel-handle=5944 /prefetch:1
  2⤵
  PID:5092
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6172,i,2444351764766242945,3218947797872406742,524288 --field-trial-handle=2340,i,12344502483881049778,5925376463022877186,262144 --variations-seed-version --mojo-platform-channel-handle=6188 /prefetch:8
  2⤵
  PID:1996
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6172,i,2444351764766242945,3218947797872406742,524288 --field-trial-handle=2340,i,12344502483881049778,5925376463022877186,262144 --variations-seed-version --mojo-platform-channel-handle=6188 /prefetch:8
  2⤵
  PID:3908
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --always-read-main-dll --metrics-shmem-handle=5192,i,536736032256459155,9748306661694208436,2097152 --field-trial-handle=2340,i,12344502483881049778,5925376463022877186,262144 --variations-seed-version --mojo-platform-channel-handle=6352 /prefetch:1
  2⤵
  PID:636
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4840,i,14752520017939583566,9135634884391921400,524288 --field-trial-handle=2340,i,12344502483881049778,5925376463022877186,262144 --variations-seed-version --mojo-platform-channel-handle=6236 /prefetch:8
  2⤵
  PID:4848
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4844,i,3896043049659696753,10966946866528531989,524288 --field-trial-handle=2340,i,12344502483881049778,5925376463022877186,262144 --variations-seed-version --mojo-platform-channel-handle=4224 /prefetch:8
  2⤵
  PID:4448
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4296,i,8948990310927043252,12580208330713723523,524288 --field-trial-handle=2340,i,12344502483881049778,5925376463022877186,262144 --variations-seed-version --mojo-platform-channel-handle=6264 /prefetch:8
  2⤵
  PID:4776
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5592,i,7624121441904025579,435782935234166866,524288 --field-trial-handle=2340,i,12344502483881049778,5925376463022877186,262144 --variations-seed-version --mojo-platform-channel-handle=5392 /prefetch:8
  2⤵
  PID:1144
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6360,i,9014438996446327875,10874310323627832798,262144 --field-trial-handle=2340,i,12344502483881049778,5925376463022877186,262144 --variations-seed-version --mojo-platform-channel-handle=5384 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:60

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:3384

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 ab98da7535c8de464335204ae97fd672936e639269325c3a388b3039d8396b83
MD5 1656a3560c7aeae221756f3891b89fd3
SHA1 e48441fe2b843ba3bd0bb7799c07b22a27db8eb7
SHA512 c06d7152d11e33601716d4c5c33c7373ac4e0c16571e80ac4a8ffb9cabb52fae51d4fe8d808fc75be943287b55a320e90a186d71a5f06e9db006f6ab89266400
TLSH
T1CFD09B307B597042D3074031E8074790169E84B5249B86066554410D7D5A485E3DF547
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 0f60f020da627b293c2f70489375b69863346ce2ddd31820984575f447ed050b
MD5 73f4bbd3ccfc7ecff13e446b37cfb197
SHA1 47a2cbea873e6f7680465620a5624aa31d70cf56
SHA512 e1094b3069133bc5f62333fb37051ac467fe66d6103cb6bbf1504692d55b74b513618af89acd0671b794353653f885c4932e9c0ee913beb62714daed78e06863
TLSH
T15171A33E101008B1F3A582B353C159C8BCB1F7FBFA23FE45E299ADB95B02745C519184
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

02a8b0a2-db02-4622-a2d0-57946936339a.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\02a8b0a2-db02-4622-a2d0-57946936339a.tmp
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 fe6966d06d2b8429e18cdaf2db0cc351d7bdaf44936bbf9c3f61ab85f5eece9d
MD5 52d7b74b5bcad3f5a7f094a5ae50d83e
SHA1 7372ff4675559eb16c222041ebdf18016c828c8b
SHA512 f965148f18ce4bc4bf4f01de5efabcab852b750241a20293fd4dad71636be89e181880a3f91204c32b37fb1a2f2830c87aa29d945b1ed6895c0ee82ff67e23a4
TLSH
T1DB51BEB7C7D9861D88025AF0EA24ED1ADD1D1A0543283D5ECAD4EF0B97F20F5E102B0E
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 849b228e75cca2e673e4d42732ff56a99689e28dd8f0586c664d0ebb839fe157
MD5 9cb2e7a2393fea0dfcfb078279738154
SHA1 b8cd06c9b773902a94bb354431fd06fc7b88c658
SHA512 ad3a668482c83f28a9ed8c6042ff05083886e6c07014fe615dc6ac818e2ddeb8aa6940786344ca7c9b1ace1829a1c5226ca47e690e03177dc79a633c16fdb9e9
SSDEEP 192:sxZwRWyM/jK1Ml8UQ9kb/fUsgvYPSIdp89HW6+WNJ4//YzHqDEIg5sJ:sxZwwqWb/fUsgvYDAHba/6+
TLSH
T13652E9166A349977CCDBD209FA45BF93D6F5447292900E44AAFCDB0C05E6BED220782F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 c0c985857292de6215f2ea439e3151dc68d51de5fa3f61267d3ec0c8c3594bd5
MD5 50addfb5bd6e0423e93c897c1f27073a
SHA1 61781794c85df0134ca6c8c1b3a9c9eb71db05a4
SHA512 2439661df4524df1888a77f4a881c6a39d3578b74e28b032e77cc41c2d8d38653bd83bd3ef871f5f994b2f44c9f46204e9be2bb7e42c866e35845dc8d6aafb9a
SSDEEP 192:sxZwRWyM/jK1Ml8Mkb/fUsbvfPSIdpK9HW6+WNJ4//YzQ7kEIgrJ:sxZwwMb/fUsbvfDOHba/v9
TLSH
T16C52E9166A349977CCDBD209FA55BF93D6F5447292900E44AAFCDA0C04E6BED2207C2F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 30KB
SHA256 60ce8ca91cda86fa1a532f99b2eff90f2762cb1f9c478254a881e21770895308
MD5 1f0ca48c2b52ff0e78f2376ffdef5623
SHA1 f1a66fd850d5ec557d3df37621065ed617e6ac3c
SHA512 7a2936926f13675490d66e1af6ca04854fe780650d20fb5dfe3ae739649dbc74dcbcc56a56bbdd8fa6c94835f16978c10c6259e9e24f746bd173e87f794962d4
SSDEEP 768:X2W7kf0Wvqina8F1+UoAYDCx9Tuqh0VfUC9xbog/OVX5LlWYSj4roIk0OYx:X2W7kf0Wvqinau1jaa5LA3jDSx
TLSH
T198E2FB3B680CCB7E4F841E5CEC266F966ED801CB67988D544BFA884C03CB6EA51175DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 6941651fc23d3db8f246ccd844468003298641db3b2d09272e55b8b72762bab0
MD5 ccacf87267417f393f0d7dfe3babf10a
SHA1 3fbe85f3ea9e1c6f71f85956207d7e5fa96e65ac
SHA512 916a1c82bdbe8def9d72b447f7c655829aafb336f2eb27c741914b7bc5add6d10f2496310f39b1dafd1ab0f571c7dab80a7067eb10f740448f9e856df3153191
SSDEEP 96:KIbCKc3/WKQouWF8BVr/7gfH6z99gKV19jgxN9qDbEgKNH:sSdWF8BVr/72H6B9J19juN9qD8H
TLSH
T1E9919A59313B06413CFE6888A2A596368E4271673859B46F3FB804A24E26E175FFC8DD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig~RFe593fbe.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig~RFe593fbe.TMP
Size 3KB
SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
MD5 904e6e94a1d46374c8630cfd86cc729f
SHA1 e1d9c3f7813878acc6510d48d95b2bf48b2e1a0d
SHA512 081e2a26252860ff8d8f7a9d0378ae56f0cc50574d13d2a121afdf74284963747ef874a4d73b1df7774cd8570972f4f513eefe0a0325fd088556d5b1ba946712
TLSH
T1DB815C4FCC0CBE77ABAB6A719A35D6B2F79131EA94518A977F8C444EE3050ED0242E50
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 19KB
SHA256 95f13d130c6a01f5905ffffe475d4fd4b545930da25de5a0836db57d00ad3e6d
MD5 c612e2d32ae249dcafca7efdd7bc4e9d
SHA1 1183822e306469e80dcdeb1644cf28a222e12aa7
SHA512 d0f22aec42ca18fed663393d439f145a3ac576054941c196087b274853bb2cebb2c61f1173f5bffda1a91c220c0e7ebd099ffd1136545f7e5776286a682cae9f
SSDEEP 384:ntNn/s3n9SfsN+3DPbl6rEddm1Q868DVcl1lIO7w/BRLTs9:nj+9UxPY4mQ868DVcLCO7w/nQ
TLSH
T1A4927C315875AC3B9DE2A585F0473A476FF8D12B9AC92E48A6DCBF1C01DF79C1302929
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 27KB
SHA256 90e7ba15f1bc6346bcc26d8041ef6554e7e2c1b602ead7def88155e48f1fee9a
MD5 0bba1aa666863b776bc9ae6464c1df41
SHA1 3364e31fd493a29a22a5c50dda60ea7781399e9d
SHA512 01981c54ef3319b2f51f193ed23482fd42da1d5f3a922378bb240e4fdc7d31be93dd2e2e9d25d8b0ec37455d362fe81da909e1833ae9695493d5facd117b94d2
SSDEEP 384:IiF1tNn/s3n9SNzsNO8TUNTUlIlcDPbljrEddm1Q898DVcl1lIO7w/BRLTs9:TF1j+9afwgyPl4mQ898DVcLCO7w/nQ
TLSH
T183C23AF248D7983AD99D5B47F37E2D035EBCC167B5852944B3886A0CCD9A2BFC302824
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 53f1bab881b6ea23505bd6b9a57880be954403a7ed3c6462da88516bebaa0aff
MD5 04ae44d0c941a74c2f75ee6e7f8fd415
SHA1 e60a347a1214ec1e8b9b80d9a63a4f1da043b90b
SHA512 9766623259bd1dd35dfc2d3d0fb921bf0eda56b578459832a406da0547ffcd0f60d153764b2f628de152636674384b825c3924cccd58790ca5875088f7c90e48
SSDEEP 192:MONE64BAQmiUya1VW5GBPKrs+FdGGm1/aDAV9U6:MONE6eAFfWDddm182U6
TLSH
T15102EA35AC786C7B9EB2AE45F48737175FE8113BA6945F44EBE86B1C009764C2342827
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 596ecf2c42c7032550c85695351beadf9f285e48398946df696f034816ab8c04
MD5 a7e006b70cea4a27d62a9e5b8450dbee
SHA1 d6661b329de4a29e451075471aaa7fbe59ac5bdd
SHA512 45e2a8b70139edd5c0e6f3d44fefacc6258cc11df7c78ca3097a296e04eda94f641914e072a3dada37169d71f2d64301353f610d47ae4eab6df59789e79a031c
SSDEEP 192:FONn64BaQmiUyBVp5GBPKrs+FdGGm1pFE8jWwAqSU6:FONn6eWkpDddm1Q8v8U6
TLSH
T11E120B316C74AC7B5D92B545F08736035EA5522BEB896F84E7EC7B1C01EF7AC2306816
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

183747ee-6a0e-4a11-adef-27a80917a73e.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\183747ee-6a0e-4a11-adef-27a80917a73e.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

fa6c534a-c7a2-4ea4-aeff-1f368259efdf.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\fa6c534a-c7a2-4ea4-aeff-1f368259efdf.tmp
Size 19KB
SHA256 a01e3572d3fdd98c12bba7fbcc216ce4452eb77d027d1bb91b91b0b274ba56e0
MD5 a59445d0f9956abba52244484a84ff0a
SHA1 99643e2b25a8161fda507ce2f7f797096518dcc6
SHA512 22b7f815e3cf67134bd5768a443937a1fceb3b8ccfca93769328c2308514dda3340134ea06cdb2c49e213fb4fcb620bb813c5536b9e38b3e69f92f2b2b4036dc
SSDEEP 384:dtNn/s3n9SfsN+cDPbl6rEddm1Q868DVcl1lIO7w/BRLTs9:dj+9UyPY4mQ868DVcLCO7w/nQ
TLSH
T149927C315875AC2B9DE2A585F0473A476FF8912B9AC92E44A6DCBF1C01DF79C1302929
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 8eab6c2c6fec7448b78deb7df5bad2962d33e8049aed0c37d9daf7b3b4a81a6d
MD5 a51193ada961105b295a73913a41332d
SHA1 bd6bc3729c27ed8def5f9e9566f90442a8204555
SHA512 32f9afa181bf74e3cf719e962f9c3dd1be69d6d77cd147cf08b521f3bccddb80eb8d07ea02a1eaedc25e005b93136cbf174dd18dfa2119dde9d61c5829b3b892
TLSH
T1F841E86CA6F91144B3B76E5AAFF6A46D487B7D772F0684AD00110D4F4B62B00CC62733
MD5 SHA1 SHA512 TLSH

Submit Download