hxxp://coloradocrisisservices[.]org

Analysis

user interaction
yes
max time kernel
150s
max time network
148s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
15/07/2026, 12:18

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
http://coloradocrisisservices.org
Sample260715-pgntkscs2p

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4724	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134285915055298939"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2937465464-4167303362-2236413517-1000\{F3907462-A65B-440A-91DD-D50F89D8A2C5}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1216	msedge.exe
1216	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 8 IoCs

pid	Process
1768	msedge.exe
1768	msedge.exe
1768	msedge.exe
1768	msedge.exe
1768	msedge.exe
1768	msedge.exe
1768	msedge.exe
1768	msedge.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
1768	msedge.exe
1768	msedge.exe
1768	msedge.exe
1768	msedge.exe
1768	msedge.exe
1768	msedge.exe
1768	msedge.exe
1768	msedge.exe
1768	msedge.exe
1768	msedge.exe
1768	msedge.exe
1768	msedge.exe
1768	msedge.exe
1768	msedge.exe
1768	msedge.exe
1768	msedge.exe
1768	msedge.exe
1768	msedge.exe
1768	msedge.exe
1768	msedge.exe
1768	msedge.exe
1768	msedge.exe
1768	msedge.exe
1768	msedge.exe
1768	msedge.exe
1768	msedge.exe
1768	msedge.exe
1768	msedge.exe
1768	msedge.exe
1768	msedge.exe
1768	msedge.exe
1768	msedge.exe
1768	msedge.exe
1768	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
1768	msedge.exe
1768	msedge.exe
1768	msedge.exe
1768	msedge.exe
1768	msedge.exe
1768	msedge.exe
1768	msedge.exe
1768	msedge.exe
1768	msedge.exe
1768	msedge.exe
1768	msedge.exe
1768	msedge.exe
1768	msedge.exe
1768	msedge.exe
1768	msedge.exe
1768	msedge.exe
1768	msedge.exe
1768	msedge.exe
1768	msedge.exe
1768	msedge.exe
1768	msedge.exe
1768	msedge.exe
1768	msedge.exe
1768	msedge.exe
1768	msedge.exe
1768	msedge.exe
1768	msedge.exe
1768	msedge.exe
1768	msedge.exe
1768	msedge.exe
1768	msedge.exe
1768	msedge.exe

Suspicious use of WriteProcessMemory 39 IoCs

description	pid	Process	procid_target
PID 1768 wrote to memory of 3884	1768	msedge.exe	85
PID 1768 wrote to memory of 4724	1768	msedge.exe	86
PID 1768 wrote to memory of 4340	1768	msedge.exe	87
PID 1768 wrote to memory of 4340	1768	msedge.exe	87
PID 1768 wrote to memory of 4340	1768	msedge.exe	87
PID 1768 wrote to memory of 372	1768	msedge.exe	88
PID 1768 wrote to memory of 372	1768	msedge.exe	88
PID 1768 wrote to memory of 3136	1768	msedge.exe	90
PID 1768 wrote to memory of 3136	1768	msedge.exe	90
PID 1768 wrote to memory of 3136	1768	msedge.exe	90
PID 1768 wrote to memory of 4812	1768	msedge.exe	91
PID 1768 wrote to memory of 4812	1768	msedge.exe	91
PID 1768 wrote to memory of 4812	1768	msedge.exe	91
PID 1768 wrote to memory of 2008	1768	msedge.exe	92
PID 1768 wrote to memory of 2008	1768	msedge.exe	92
PID 1768 wrote to memory of 2008	1768	msedge.exe	92
PID 1768 wrote to memory of 2316	1768	msedge.exe	93
PID 1768 wrote to memory of 2316	1768	msedge.exe	93
PID 1768 wrote to memory of 2316	1768	msedge.exe	93
PID 1768 wrote to memory of 2576	1768	msedge.exe	97
PID 1768 wrote to memory of 2576	1768	msedge.exe	97
PID 1768 wrote to memory of 2576	1768	msedge.exe	97
PID 1768 wrote to memory of 3948	1768	msedge.exe	99
PID 1768 wrote to memory of 3948	1768	msedge.exe	99
PID 1768 wrote to memory of 4352	1768	msedge.exe	98
PID 1768 wrote to memory of 4352	1768	msedge.exe	98
PID 1768 wrote to memory of 4708	1768	msedge.exe	100
PID 1768 wrote to memory of 4708	1768	msedge.exe	100
PID 1768 wrote to memory of 4708	1768	msedge.exe	100
PID 1768 wrote to memory of 5076	1768	msedge.exe	102
PID 1768 wrote to memory of 1204	1768	msedge.exe	105
PID 1768 wrote to memory of 1204	1768	msedge.exe	105
PID 1768 wrote to memory of 1204	1768	msedge.exe	105
PID 1768 wrote to memory of 3640	1768	msedge.exe	112
PID 1768 wrote to memory of 2924	1768	msedge.exe	113
PID 1768 wrote to memory of 3012	1768	msedge.exe	114
PID 1768 wrote to memory of 2160	1768	msedge.exe	116
PID 1768 wrote to memory of 2160	1768	msedge.exe	116
PID 1768 wrote to memory of 1216	1768	msedge.exe	118

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument http://coloradocrisisservices.org
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1768
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x28c,0x7ff9116dc188,0x7ff9116dc194,0x7ff9116dc1a0
  2⤵
  PID:3884
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1992,i,14869522105412953701,13009568419574604821,524288 --field-trial-handle=2120,i,3046182424661300742,7816426735149027979,262144 --variations-seed-version --mojo-platform-channel-handle=2160 /prefetch:3
  2⤵
  - System Time Discovery
  PID:4724
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1804,i,1219336106282088254,10729232593892929560,262144 --field-trial-handle=2120,i,3046182424661300742,7816426735149027979,262144 --variations-seed-version --mojo-platform-channel-handle=2112 /prefetch:2
  2⤵
  PID:4340
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2404,i,8019430595484780270,10636252027882277359,524288 --field-trial-handle=2120,i,3046182424661300742,7816426735149027979,262144 --variations-seed-version --mojo-platform-channel-handle=2472 /prefetch:8
  2⤵
  PID:372
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3428,i,11557511920864070113,10505387200131778023,2097152 --field-trial-handle=2120,i,3046182424661300742,7816426735149027979,262144 --variations-seed-version --mojo-platform-channel-handle=3488 /prefetch:1
  2⤵
  PID:3136
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3432,i,1973098210701762595,10615508359772426127,2097152 --field-trial-handle=2120,i,3046182424661300742,7816426735149027979,262144 --variations-seed-version --mojo-platform-channel-handle=3492 /prefetch:1
  2⤵
  PID:4812
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4212,i,17732879932255488298,16422035664161594309,2097152 --field-trial-handle=2120,i,3046182424661300742,7816426735149027979,262144 --variations-seed-version --mojo-platform-channel-handle=4356 /prefetch:2
  2⤵
  PID:2008
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4200,i,13531603946595223152,9140323659286438713,2097152 --field-trial-handle=2120,i,3046182424661300742,7816426735149027979,262144 --variations-seed-version --mojo-platform-channel-handle=4244 /prefetch:1
  2⤵
  PID:2316
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=5052,i,5645706923906626108,1461302882969846784,2097152 --field-trial-handle=2120,i,3046182424661300742,7816426735149027979,262144 --variations-seed-version --mojo-platform-channel-handle=5060 /prefetch:1
  2⤵
  PID:2576
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3536,i,9274397620734868635,1703214314648678119,524288 --field-trial-handle=2120,i,3046182424661300742,7816426735149027979,262144 --variations-seed-version --mojo-platform-channel-handle=3956 /prefetch:8
  2⤵
  PID:4352
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3444,i,8049830619742162189,14663176509706385403,524288 --field-trial-handle=2120,i,3046182424661300742,7816426735149027979,262144 --variations-seed-version --mojo-platform-channel-handle=3936 /prefetch:8
  2⤵
  PID:3948
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --always-read-main-dll --metrics-shmem-handle=5516,i,17814905154037902304,6896171005530061957,2097152 --field-trial-handle=2120,i,3046182424661300742,7816426735149027979,262144 --variations-seed-version --mojo-platform-channel-handle=5572 /prefetch:1
  2⤵
  PID:4708
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5992,i,3865180268814215855,13089682897447347057,524288 --field-trial-handle=2120,i,3046182424661300742,7816426735149027979,262144 --variations-seed-version --mojo-platform-channel-handle=6008 /prefetch:8
  2⤵
  PID:4384
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5992,i,3865180268814215855,13089682897447347057,524288 --field-trial-handle=2120,i,3046182424661300742,7816426735149027979,262144 --variations-seed-version --mojo-platform-channel-handle=6008 /prefetch:8
  2⤵
  PID:5076
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --always-read-main-dll --metrics-shmem-handle=6476,i,6685262402549087559,5784953686444641025,2097152 --field-trial-handle=2120,i,3046182424661300742,7816426735149027979,262144 --variations-seed-version --mojo-platform-channel-handle=6356 /prefetch:1
  2⤵
  PID:1204
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=756,i,7959979404249278309,6317156627471318619,524288 --field-trial-handle=2120,i,3046182424661300742,7816426735149027979,262144 --variations-seed-version --mojo-platform-channel-handle=4744 /prefetch:8
  2⤵
  PID:3640
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3792,i,3971279257194812147,7991879583866919798,524288 --field-trial-handle=2120,i,3046182424661300742,7816426735149027979,262144 --variations-seed-version --mojo-platform-channel-handle=5168 /prefetch:8
  2⤵
  PID:2924
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4204,i,5942757321997992813,9594416229518472904,524288 --field-trial-handle=2120,i,3046182424661300742,7816426735149027979,262144 --variations-seed-version --mojo-platform-channel-handle=5172 /prefetch:8
  2⤵
  PID:3012
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1048,i,14717294435420145311,13679188225396259388,524288 --field-trial-handle=2120,i,3046182424661300742,7816426735149027979,262144 --variations-seed-version --mojo-platform-channel-handle=5368 /prefetch:8
  2⤵
  PID:2160
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6396,i,4414298099890682447,17042550598753918473,262144 --field-trial-handle=2120,i,3046182424661300742,7816426735149027979,262144 --variations-seed-version --mojo-platform-channel-handle=6580 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1216

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:3860

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

blocklist

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\blocklist
Size 105KB
SHA256 ae10af80c983ecdad438965cb208911f945e43bc36fe488247e2cd8bad97b450
MD5 f5ccd04bc3cab603843f2aa41a035cdb
SHA1 a4745772a8bc8f2c6e201e674b2ae558abaeb5f0
SHA512 e655264449a4bb6b25d28102be4b80887fc34a446f6baa3f02657035b3c41c200becbfdfe3947962121baf11f7b7315d8b709736af52453e82162331001d4608
SSDEEP 1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P7A:fwUQC5VwBIiElEd2K57P7A
TLSH
T121B3B931457E36BF26E93EE828CF1511B84F3912664895D4ABE1FE2C4845E68633CEF4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 3eacdfce7dc5d437b4447cf27ab297d2d39d13a22d53487691f060212cddb6b2
MD5 77a76342e47369b91c295856d0d136ad
SHA1 bac334fe99bd25a56aeb5cf09b273fd394730180
SHA512 5594ac61907f341c5e00a7e62a64d33fde684c855aa9b27d0c2756986334fbea5ebaf894d13dfedefe84d1f7ad65aaa17fb6b204714ed08460f06e4ed17ce733
TLSH
T1AAD012223A48F441DB4942709103CF453B26146024579A06E259D86D58B41D453D66C2
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 7aa2bb81937fdcdafd5d33143cfe61093f5233469b36757de171e12cc0c6215f
MD5 6503f091cfa7258a2190ed65490b1bdd
SHA1 d722a7fd3cd82ec30e4846b9511ec1c22b9dacfd
SHA512 5f2a6a53348e4e1b7810b77abe2dd4c597357ba365cf029977f0efbbb203eab9dfb7771c9edb3561b6d22c8b7354c34611905cfbaab36c763b9d3334beb40b4c
TLSH
T1BAD012223A48F441DB4942709102CF453B26146024579A06E259D86D58B51D453D66C2
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 4KB
SHA256 22fe4225bc4748253f1916c870a0e2e7b334749e87e68e5285fc46554cd05962
MD5 721413e3e44e105d4142d34eb983e298
SHA1 f7488c50024cab10d69f18bc8a25ac9ac5eaea66
SHA512 fbb2be97276487924f92b521cb95b8e886b8639b10ba35232044ab852bc840dc403c4ad9649ca59e96d6493705c73be9610674289a4e9eb9e3a85434dae5fc84
SSDEEP 48:hYiXfwsZWvdVSBP3md00w1wW8geattKCmI+W4ap3m0B03W2o5Ns8U9qwV2xYaYPb:OVYOQ8WKn03/dyqdYD0Xcp5zd
TLSH
T142912E0D87833CFAF7705033F09EA9123B70C555BBA76E1194D494BE731E7AC51A242A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index~RFe58d339.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe58d339.TMP
Size 3KB
SHA256 befa1cf1c8fcb852d64d73c6a0697f45a3bdd72f392918c2161040216d282c95
MD5 5475de6d0bf1d46f630e87c7c98b1e83
SHA1 9cbff5a4f0037998bba4f97cfd86c9d662c7ea09
SHA512 686f3f7472790d600a1c34a437bbb78d5703f06d9f639fed0014384755e3cb57aa3878480a49da0309f39a8f284d2c7ef8a258e5cae04918ddb3ae5c2e6b5901
TLSH
T11E612A0A87534CE1F3701173F4AE42463BB1C199FBB79E10A5E484BDB72CB6D816652B
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

HubApps

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\HubApps
Size 106KB
SHA256 eb2fd7422436fff93f6be09df3294b26cdb7afd18e6aa94dcdc0f208db78b2ed
MD5 25dca813dd764f2197142ef84bc5ce66
SHA1 8d6aefb01ee9f6d1fb0cfd89326cfe35af53a53d
SHA512 a9c8cd547c874b7b69cbb3a0c8214f43837911e522db768dcd075d23d05acfd7122cf2bcad281ea745025e4fb67cc9061b79f9dc1288ac1a113bd0d961841d43
SSDEEP 1536:IfEEtnH74ohBGZqW3iPPDuVvpBI/SvtZsA62UYPq:BuHSRhPjU1
TLSH
T154B35226D6A54C6B01F16264EC794382F325436F9282A82F3B7C5D5C2FBD93A6502F7C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 9KB
SHA256 b4d161c833ff2b5ddef9031062e5daf3b7271c12a97492bbf87e4e7060a8a8db
MD5 a5662fdaf7583de9979c7daa0942c0f1
SHA1 4a6aa4db075bb02ee8024070f81db3714a5b8444
SHA512 39c07a44a6ade6bf916d816ac44f2ddac0450a0ab69b9006921e18943ff197f850f11f98addb72bc5f57c59f3c2e01db5e048f716db78c2d9388d9751dc7643f
SSDEEP 192:Dp6DeYOMsexfeLDeeWcWoo15Nrr4RFEdzDDkX7qaosVzIzGyVVRe9h9j6DybTIK:Dp6DeYOMsexfeLDeevDo15Nrr4RFEdzi
TLSH
T10A12CEB7C2E49A6D8A2116F1E7287D1FCE2B0424436C3D1BC9DAAF4757D35B1D10298E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 549c340535eee327f2b71d69c57517d6c18b849ad0a395cf84cbddf52753d891
MD5 0667bbff2d2df20681e576a3014986a6
SHA1 82c065ae0ca1c92f67f85cd775de0f3192cbddb6
SHA512 424874c207d1527fe4a1a6b8af29a1c25477138ea392c93a926c1d26921ad5eb662e60b22865deb64d2683d7c92bb9535d8f581607da2d145d01c4f7197d14d4
SSDEEP 192:sxZ7RCyM/jK1Ml8Mk5/f4sc0JOPIdpMWHW6+WNmz4/YLSEeznIgrJ:sxZ74M5/f4sc5g7Hbp/X9
TLSH
T19952D9166A34697BCCDBD209F955BF53D6F90472D3900E44AAFCDA0C04E6AED221782F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 0058e84cb5f667fd69229a78ad1d48ce8642dd9fe62071a3c85c0530bccc3b4e
MD5 a869e209b6938f2a74afb925350b2e1b
SHA1 36adb187f91dfd616ade7a23a7d6985a8b1091a2
SHA512 3df5a4dd45659beef1bcdd1e88fb348f0b97cb71b842b30efd202fd1b6126a3aa2f7fcda2e7c2180214e6f1949eaad26c6402f24248094c86f9ed656c5c87f32
SSDEEP 192:sxZ7RCyM/jK1Ml8UQWk5/f4sHqJOPIdp6WHW6+WNmSBdYLWPUznIg5lJ:sxZ7Yq95/f4sHbg9HbddmR
TLSH
T19652E8166A345977CCDBD209B945BF93D6F5147392940E44AAFCDA0C00E6BED221782F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 30KB
SHA256 faee7a356ea5edfec8ae6c5b648c6d2dbbc7b51d20c0af1c54d40387a7669608
MD5 f67dc7f7b36ccb8181d10a44df5827f7
SHA1 eb952f8c93972b21f21430e1b49e97d668e9bab6
SHA512 cf46c190a87433b25e487382e76fae9ced968f7f0c5621cc90990980e32ff09660358727ea98925357c5ed33a3e18772c7800289d8f012de4f64205bf0860b39
SSDEEP 768:kOs6pD1WvxzWj8F1+UoAYDCx9Tuqh0VfUC9xbog/OVEILlWwJNfroXe:kOs6pD1WvxzWju1jahILIsNMXe
TLSH
T1F2D2FB3B680CCB7E4F841E5CEC2A6F966DD801CBAB94895447FA844C03C77EA512759B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 7KB
SHA256 aeaaf99c863cf0282089927492c289fd766673adcd694194400991380ef54b22
MD5 4acff13e48c8a3653d0cc5eca8654c70
SHA1 bd5258e1396c4a7a8f4cbbf871d9e7cedd584319
SHA512 44594b69991d4595432da1193c0f0f9029e55d8d16d1712de9031cd3440522f75e2c5ab47ba6aab14ac2bd34e3bd2c0fd509dcf04e879ea942a22fdc117ee2ea
SSDEEP 96:KUAAKtePGhOKy46CK8K/aMHeKIoWKqsKHqErC:ii1Z3CN/m
TLSH
T191E18A42727702113C7E6908929987679F9276A33514E42B3BA850F34EB7E341DFD8ED
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f6919cd1-46b0-48f5-9b5b-f267d5390fd2.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\f6919cd1-46b0-48f5-9b5b-f267d5390fd2.tmp
Size 13KB
SHA256 4011e9fc0633e51847ca5d626d61a36fce55d6a3d5ed2fce367e6e6ffe88a0ed
MD5 a5bc2be7be8fdbe902ef5b276e626e72
SHA1 84cc74367bc39939a18b5abaaac355702cf1748f
SHA512 b8e20bb7a4e0d7898b6ff0b1d63a0bd290bc51102cd383edeededd94c36c720815c9a2c8048f0550baee2dbefc3646dd05e1331af5dad434f3f4b77cfa0e5d1c
SSDEEP 192:sxZ7RCyM/jK1Ml8Mk5/f4sH0JOPIdpMWHW6+WNmLJVYLeEeznIg5XJ:sxZ7YM5/f4sH5g7HboVnP
TLSH
T19F52E9166A34597BCCCBD209FA45BB93D6F9047293900D44AAFCDA0C04E6BDD2217C2F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig~RFe593965.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig~RFe593965.TMP
Size 3KB
SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
MD5 904e6e94a1d46374c8630cfd86cc729f
SHA1 e1d9c3f7813878acc6510d48d95b2bf48b2e1a0d
SHA512 081e2a26252860ff8d8f7a9d0378ae56f0cc50574d13d2a121afdf74284963747ef874a4d73b1df7774cd8570972f4f513eefe0a0325fd088556d5b1ba946712
TLSH
T1DB815C4FCC0CBE77ABAB6A719A35D6B2F79131EA94518A977F8C444EE3050ED0242E50
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 19KB
SHA256 9ad7ece6ee33e7de359ec7a82b37b385246cf26b36344a24667fb58243456463
MD5 77c5eec150942b044b3501209fd374d8
SHA1 6aa06fa6cb96820c00aa492cf7bf4e2c48b0b8e2
SHA512 f3fadf5b2ead316a0836a09c06f1ab0acbdece561452c3afa2698bd727e3de9b2eed5045937c094661be7c7e45b980ce2c096da5c4c891a884e496e995eb2287
SSDEEP 384:YtNn/s3n9SfsNR0YWfJgw4a9pd1sGDVcl1lIO7w/uJk:Yj+9Unywhb0GDVcLCO7w/3
TLSH
T1F7927C36A8786C7B59E2A585F147360B9FF894778ACA2E40D5DDAF0C00DFA9C0306D26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 27KB
SHA256 7393f68b6909c87d918119d56f226f5f797a88d6c006b38fdd79515e90a5dfac
MD5 eb0c12850649615b313d2cfb842ce51c
SHA1 9e1c83388aa66d12d9f6e16a8155cec2e10173e9
SHA512 de8fce2a64d02fc28c2c5cb0c23a3218109ceb62695a6aa0672281167c397859aba98820ead5e675ffc67075655eb7a9a17395e214baf588681545fe1ebc1ac6
SSDEEP 384:DiF1tNn/s3n9SgzsNj8TUNTUlIlpYWfJfw4a9pd1DGDVcl1lIO7w/uJk:uF1j+9DuwgNZwhbbGDVcLCO7w/3
TLSH
T112C218F258D7987AD9AD5B47F77E2D078EBCC067B9856940B3885A0CCC8A1BFC306815
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 06aac74ddf0644e1a6189d1baab9258da1903aa47a2839b496537d6602b6ed48
MD5 8ba7e75d70640d0b8d4e4b3e1b2219c9
SHA1 fae21a9e8f71550167631b15d0d73e2801c2f34a
SHA512 86ccadc0db950d530b8006e74337223027d934eb8c05720b661ff72f795cb2aa55fa491808dd405e3e223c94631a0cd5d853b3162b6fcfd36f335ba4d4433431
SSDEEP 192:qON66O7+3hQmiUyH5Gttb0/+Fd1DgGjNiU6:qON661aGt9pd1HQU6
TLSH
T11D02E7396C782CA78EF2AD45F68727179FA5117BE9A62B40DAE85E0C00D765C2343827
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 19KB
SHA256 eac27ba493e6dcd468c438853828916e4fe569c070ab2df3fc482db6f439175a
MD5 0a4f1adf2f9cfbb85ac7a2dda70c2a18
SHA1 a2cb29c002950b42be9f4ecc26ad946ed8ee0642
SHA512 e67c1fe7330a53abcda41b73a4d5fb80ccb80dc37f08922731222638cb33b38e2b240a94adefea94504b24069ea69c297092498dc0e651b3fadcab9952a4df86
SSDEEP 384:0tNn/s3n9SfsNRpYWfJgw4a9pd1sGDVcl1lIO7w/uJk:0j+9Uyywhb0GDVcLCO7w/3
TLSH
T16F927D36AC786C7B59E2A585F147360B9FF894778ACA2E40D5DDAF0D00DFA9C0306D26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 c99a198bb93a2c82e03b70aca7aaca29f9fc471bab913a28327db2722080bbad
MD5 a2bed9ca916b33d897435803065e63fd
SHA1 d5b7506fb7127f04d030641ab97a0b78d8e8c8ce
SHA512 e754f6e2492a8e3dbaffc6aea3b59e2a5e0c902f6fb4eabf284ac87e607a32d44a76bc573341d32a6e720ed5e7e0ba2af95425d0dba115d9819129f97fe3746d
SSDEEP 192:vONE6O7+38QmiUyt5jttb0/+Fd15GfcNjBqtZU6:vONE6Wqjt9pd1ZGU6
TLSH
T1C0120A357C786CAB5EE2A445F58732179FA5417BDE8A7B80D5EC5E0C00EF5AC2306827
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f85be28d-55e1-4eb1-ad15-3cb8df61d6b6.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\f85be28d-55e1-4eb1-ad15-3cb8df61d6b6.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 0f304a4481cd44b17bafbee866eb719e0b3791d3f957fcc35b5c2967ac9d7c8a
MD5 1cd09e465729decbd93ef0cd76f38ee0
SHA1 f71f4e455c3dac7fa459e7711937f90b3a8f044c
SHA512 e9d55634a95677580473076b505e89d2e5a682fba8e117b96dfeeab4ade8cc00f09a6daa291a6ee3bf9f2137cee3512db0e4e521f6cecbd9b6d24b7ed4dff4f9
TLSH
T1F5413A58B6FA1149B3B76E1A9BF7696E447B7C272E0AD55D00120E4F0A33B41C8B2737
MD5 SHA1 SHA512 TLSH

Submit Download