9ea0aeafd3384b5256708bc3338603a6c00536e500ad67f68be9c2ce505ca9de

Analysis

max time kernel
148s
max time network
147s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
16/07/2026, 12:19

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
websitess/web1/index.html
Size 22KB
Sample260716-phpr9sc13p
SHA256 9ea0aeafd3384b5256708bc3338603a6c00536e500ad67f68be9c2ce505ca9de
MD5 38a9e1b235714f106b8c66fab1eee9a2
SHA1 830c54e00da0b1d5bc20cfda9d9de707c6e2a389
SHA512 8932835b9f4f19afbe97572625de0be7d9b7ff6e4fff43d5d33aece36207e79dcf12f3a333ef0f0e59c02f064504dd4e2965ff9a666a14c9d15bd42d56907161
SSDEEP 384:fiIZXrgv4DOySMQSz+4Ntlzun9AholAMi:6IZXr41S3Cn9Ahr
TLSH
T1A7B2C41DB906006881B3B369AFB7631CF7675223960346253EEC83824F79A5685A3FDC
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4648	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134286780085596180"	msedge.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1788976790-1541110888-1636651838-1000\{68C5A20C-AD83-4519-AE26-B8D37D6E48FB}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2764	msedge.exe
2764	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
2964	msedge.exe
2964	msedge.exe
2964	msedge.exe
2964	msedge.exe
2964	msedge.exe
2964	msedge.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
2964	msedge.exe
2964	msedge.exe
2964	msedge.exe
2964	msedge.exe
2964	msedge.exe
2964	msedge.exe
2964	msedge.exe
2964	msedge.exe
2964	msedge.exe
2964	msedge.exe
2964	msedge.exe
2964	msedge.exe
2964	msedge.exe
2964	msedge.exe
2964	msedge.exe
2964	msedge.exe
2964	msedge.exe
2964	msedge.exe
2964	msedge.exe
2964	msedge.exe
2964	msedge.exe
2964	msedge.exe
2964	msedge.exe
2964	msedge.exe
2964	msedge.exe
2964	msedge.exe
2964	msedge.exe
2964	msedge.exe
2964	msedge.exe
2964	msedge.exe
2964	msedge.exe
2964	msedge.exe
2964	msedge.exe
2964	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
2964	msedge.exe
2964	msedge.exe
2964	msedge.exe
2964	msedge.exe
2964	msedge.exe
2964	msedge.exe
2964	msedge.exe
2964	msedge.exe
2964	msedge.exe
2964	msedge.exe
2964	msedge.exe
2964	msedge.exe
2964	msedge.exe
2964	msedge.exe
2964	msedge.exe
2964	msedge.exe
2964	msedge.exe
2964	msedge.exe
2964	msedge.exe
2964	msedge.exe
2964	msedge.exe
2964	msedge.exe
2964	msedge.exe
2964	msedge.exe
2964	msedge.exe
2964	msedge.exe
2964	msedge.exe
2964	msedge.exe
2964	msedge.exe
2964	msedge.exe
2964	msedge.exe
2964	msedge.exe

Suspicious use of WriteProcessMemory 35 IoCs

description	pid	Process	procid_target
PID 2964 wrote to memory of 1552	2964	msedge.exe	86
PID 2964 wrote to memory of 4648	2964	msedge.exe	87
PID 2964 wrote to memory of 1300	2964	msedge.exe	88
PID 2964 wrote to memory of 1300	2964	msedge.exe	88
PID 2964 wrote to memory of 1300	2964	msedge.exe	88
PID 2964 wrote to memory of 2608	2964	msedge.exe	89
PID 2964 wrote to memory of 2608	2964	msedge.exe	89
PID 2964 wrote to memory of 4520	2964	msedge.exe	91
PID 2964 wrote to memory of 4520	2964	msedge.exe	91
PID 2964 wrote to memory of 4520	2964	msedge.exe	91
PID 2964 wrote to memory of 2988	2964	msedge.exe	92
PID 2964 wrote to memory of 2988	2964	msedge.exe	92
PID 2964 wrote to memory of 2988	2964	msedge.exe	92
PID 2964 wrote to memory of 560	2964	msedge.exe	93
PID 2964 wrote to memory of 560	2964	msedge.exe	93
PID 2964 wrote to memory of 560	2964	msedge.exe	93
PID 2964 wrote to memory of 4476	2964	msedge.exe	94
PID 2964 wrote to memory of 4476	2964	msedge.exe	94
PID 2964 wrote to memory of 4476	2964	msedge.exe	94
PID 2964 wrote to memory of 2544	2964	msedge.exe	97
PID 2964 wrote to memory of 2544	2964	msedge.exe	97
PID 2964 wrote to memory of 4488	2964	msedge.exe	98
PID 2964 wrote to memory of 4488	2964	msedge.exe	98
PID 2964 wrote to memory of 1040	2964	msedge.exe	100
PID 2964 wrote to memory of 4860	2964	msedge.exe	102
PID 2964 wrote to memory of 4860	2964	msedge.exe	102
PID 2964 wrote to memory of 4860	2964	msedge.exe	102
PID 2964 wrote to memory of 3172	2964	msedge.exe	109
PID 2964 wrote to memory of 4896	2964	msedge.exe	110
PID 2964 wrote to memory of 4432	2964	msedge.exe	111
PID 2964 wrote to memory of 2596	2964	msedge.exe	121
PID 2964 wrote to memory of 2596	2964	msedge.exe	121
PID 2964 wrote to memory of 3004	2964	msedge.exe	122
PID 2964 wrote to memory of 3004	2964	msedge.exe	122
PID 2964 wrote to memory of 2764	2964	msedge.exe	123

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument C:\Users\Admin\AppData\Local\Temp\websitess\web1\index.html
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2964
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x278,0x7fff9750c188,0x7fff9750c194,0x7fff9750c1a0
  2⤵
  PID:1552
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1864,i,5053813959171583662,9552582330279937004,524288 --field-trial-handle=2100,i,7147724732339867452,3753503951693943594,262144 --variations-seed-version --mojo-platform-channel-handle=2212 /prefetch:3
  2⤵
  - System Time Discovery
  PID:4648
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1636,i,1207390440503821223,6768391371059499492,262144 --field-trial-handle=2100,i,7147724732339867452,3753503951693943594,262144 --variations-seed-version --mojo-platform-channel-handle=2096 /prefetch:2
  2⤵
  PID:1300
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2288,i,4027493831078976192,8339935968454302931,524288 --field-trial-handle=2100,i,7147724732339867452,3753503951693943594,262144 --variations-seed-version --mojo-platform-channel-handle=2628 /prefetch:8
  2⤵
  PID:2608
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3440,i,388883999129701648,15736063966743931369,2097152 --field-trial-handle=2100,i,7147724732339867452,3753503951693943594,262144 --variations-seed-version --mojo-platform-channel-handle=3480 /prefetch:1
  2⤵
  PID:4520
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3464,i,16863585843714966574,11085206117820657093,2097152 --field-trial-handle=2100,i,7147724732339867452,3753503951693943594,262144 --variations-seed-version --mojo-platform-channel-handle=3544 /prefetch:1
  2⤵
  PID:2988
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4196,i,5202110883120600074,8257114681509040965,2097152 --field-trial-handle=2100,i,7147724732339867452,3753503951693943594,262144 --variations-seed-version --mojo-platform-channel-handle=4112 /prefetch:1
  2⤵
  PID:560
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4208,i,791461713499257732,17675579328004975110,2097152 --field-trial-handle=2100,i,7147724732339867452,3753503951693943594,262144 --variations-seed-version --mojo-platform-channel-handle=4340 /prefetch:2
  2⤵
  PID:4476
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5128,i,3896275092660366663,9114936805188146142,524288 --field-trial-handle=2100,i,7147724732339867452,3753503951693943594,262144 --variations-seed-version --mojo-platform-channel-handle=5208 /prefetch:8
  2⤵
  PID:2544
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5132,i,16474708593450758615,16795680101212047948,524288 --field-trial-handle=2100,i,7147724732339867452,3753503951693943594,262144 --variations-seed-version --mojo-platform-channel-handle=5228 /prefetch:8
  2⤵
  PID:4488
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5924,i,10090074979383111600,113471986346835273,524288 --field-trial-handle=2100,i,7147724732339867452,3753503951693943594,262144 --variations-seed-version --mojo-platform-channel-handle=5944 /prefetch:8
  2⤵
  PID:2780
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5924,i,10090074979383111600,113471986346835273,524288 --field-trial-handle=2100,i,7147724732339867452,3753503951693943594,262144 --variations-seed-version --mojo-platform-channel-handle=5944 /prefetch:8
  2⤵
  PID:1040
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --always-read-main-dll --metrics-shmem-handle=6268,i,11508344569626209766,13047470689820248387,2097152 --field-trial-handle=2100,i,7147724732339867452,3753503951693943594,262144 --variations-seed-version --mojo-platform-channel-handle=6260 /prefetch:1
  2⤵
  PID:4860
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4532,i,13207618664766035546,13627176724254535687,524288 --field-trial-handle=2100,i,7147724732339867452,3753503951693943594,262144 --variations-seed-version --mojo-platform-channel-handle=4516 /prefetch:8
  2⤵
  PID:3172
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4356,i,11250353622241288552,852712805655550910,524288 --field-trial-handle=2100,i,7147724732339867452,3753503951693943594,262144 --variations-seed-version --mojo-platform-channel-handle=4508 /prefetch:8
  2⤵
  PID:4896
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4384,i,10723895507921901203,4236129970432700518,524288 --field-trial-handle=2100,i,7147724732339867452,3753503951693943594,262144 --variations-seed-version --mojo-platform-channel-handle=4208 /prefetch:8
  2⤵
  PID:4432
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5164,i,1769299164924548956,2094713997639326965,524288 --field-trial-handle=2100,i,7147724732339867452,3753503951693943594,262144 --variations-seed-version --mojo-platform-channel-handle=2784 /prefetch:8
  2⤵
  PID:2596
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1792,i,3721976725429942769,9173443373270861381,524288 --field-trial-handle=2100,i,7147724732339867452,3753503951693943594,262144 --variations-seed-version --mojo-platform-channel-handle=756 /prefetch:8
  2⤵
  PID:3004
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6228,i,6110193908601865778,7331913540332846872,262144 --field-trial-handle=2100,i,7147724732339867452,3753503951693943594,262144 --variations-seed-version --mojo-platform-channel-handle=5212 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2764

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:4552

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

blocklist

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\blocklist
Size 105KB
SHA256 994380ffd288a5f1a9acc9eb76a487a55b12cc1daec839d811240f6cbdc4da3a
MD5 f5ed4946834be586ac6410ed88740a7c
SHA1 6108ce368e8b3bb8012956bb25606c3b16835c7b
SHA512 76bf60b37c50422ab125edd3da70629e685408a106655a9b7e5cb6aa7b6a9000c76d8ac2f5dc85e58e893b61bef9b539b9488ac894f1fc1338a58944dc9f4711
SSDEEP 1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P77:fwUQC5VwBIiElEd2K57P77
TLSH
T1E5B3B931457E36BF26E93EE828CF1511B84F3912664895D4ABE1FE2C4845E68633CEF4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 6d0f88884e23b1418c456620b79662feebdfd970ca9325ba2981c94b3b0f0b2f
MD5 7060eae8ec426d15de2849b1f7d261b4
SHA1 b252d90b9d7050d0b9b7c03141d9d3b7cae404ac
SHA512 8791005fae20dc1dc5dc5b0086efe814e0b1e36781ef1931cc1fc699fc4cb34d62ab3f9a83f4967824f3bb71aef6adc6ad457ab7a6addcba99f9e9b473eabb4d
TLSH
T118D01222BE08A415E65BA271A502C7141F5954A124938651E224D86CD9F84D49696387
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 4d517b88a0fb88494276c126764235de9ee52961c86cc4d3abaf517b10a649a8
MD5 dde9ea8dd9c7e315ef614ab3476af02c
SHA1 e03e201e89770d15b4040d579c2cce8684959a2c
SHA512 410e016336529d709de957d44e67238e4f6592b9ce6646395a9e45ce592e7810b4cb6b1b6df5d8b26875a6aa235b77d41c0983ccc055556f8b8c02224093fdd1
TLSH
T16DD012227E08A415E65BA271A502C7141F5954A124938651E224D86CC9F94D49696387
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 72351ba65508eb055ccf15eb25716789b652e53f6fa64794a3993f6baaeba091
MD5 73639f2cb0023f58138efa17e3208e0e
SHA1 2c2c67d76750c8cba5c7b3aa01b0914932b778f4
SHA512 76323897750600d5b670a760e2e03b41d741e9d5f63d2c347d99586453c8989121527c5ea5369e683c4cfb184640b008a94daaf27bd0bbd3f79a626f8bad7067
TLSH
T1FA6180390976E318F332637288FD62F930B2A2EDF1174C898144D87C1006BA0C79AE9C
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe588066.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe588066.TMP
Size 3KB
SHA256 78c848fd1a76b9953e767409726cb126f0e5793cf7a8d5bbd15a06ad7bb476be
MD5 fb3859c9bf881abddbfbb7e776c88922
SHA1 3fcc00d80ce4fb4eb7fda7fa36efb4b1697223a7
SHA512 35a32901ccc588ff84d8f10d8706da2cf522a9e08c3d58cb4a323616dc91d1e5e6888f70aa0429f7bb6fa22cb9f04d5cf233fdafcbea6c9dc8801690b49e3080
TLSH
T14E618F390976A318F332633288FD62F930B2A2EDF1574D898044D87C1006BA0C79AE9C
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 949B
SHA256 15896c788a4f2f6b3dabe1e7f44acbefde0600d8a94ce82d32d5bba956c954a3
MD5 77d38a362ea08841d7b113367ba227ea
SHA1 57aa9079d4246c0d0f029061f6bf458dd8384014
SHA512 3e7d0013c4821ff4ff9497eee9e8405d7cfd8ab889f25106b1bd517b485d6caafbd954ff727e8701717d87b2b0426ccc725ed978ccfb3509793612830036ddfc
TLSH
T194117DF3C3D5856E890156F06A28AE2BDE2D0915431C7C2985D4FF2BD7E3475E10155B
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 abbb3c16ef4293e6662fb6b8cd054d78580b2d1d743542edfae1a841f8286728
MD5 21c5699618ecc996c36824c1f9863158
SHA1 77221cecc1117aec430984a4d54f7e888bdf4f63
SHA512 24aefc6a5e514f797a4438f801af551db75f721bbd0e217fee47d4b091be4fb4fe1dcf6c0703042361b470a041375540d2ebec2e57ee368b59720f0c36969f58
SSDEEP 192:sxZUjkRJdyM/jK1Ml8MkZv/f5/sQyUcVJpIdpdUZHW6+WNGYvrUa9SJ15sxIgrJ:sxZlRMp/fhsQycYHbG7K9
TLSH
T1BC42FA12AB345977CCDBD20DFA55BF93D6F90572A2900D44AAFCCA0C04E6AED221781F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 641ccbefe9ae9c38caecd4397d7a90bd769142bfddb2d2e63990c6714f16f226
MD5 8c58b8a7eb47d1bc9ee6797fd0e53470
SHA1 bb2ea5627e2039a7cb00fe4779b509b9d899eba1
SHA512 75f1dcc6428b6a53957141792f71e67e4e553fb37afe4bef7efc5f2c885dd4951bcf6e684f4d83985f2ae8af8c8f17002cd9973b72a36d1e88fe7dac17f6ebe3
SSDEEP 192:sxZUjkRJdyM/jK1Ml8UQZ7kZv/f5/sZT1APUcVJpIdpHUZHW6+WNGYvJUl9DkJ1D:sxZlRqep/fhsJuPcWHbGEKY
TLSH
T1A052E912AA385D77DCDBD20DF945BF93D6F90472A2900E44AAFCCA0C05E6ADD621781F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 30KB
SHA256 d6626fea842c86577405f36c6073f5bdcd8be01251d61a8815f2899edaad2ebf
MD5 b36315604ae3e8dacd29925c7e3954c3
SHA1 f38f38f1f70476c4c9f2d13544f596ddbb87e3f4
SHA512 825cb019a49c5e6c752c880aa79e0c4162886306387ca5965d841db83f2da3b8405f3dd090142e9b2409931b968c3481598f7d240e1b6e324d2c255da27a0ac3
SSDEEP 768:VdseJ3xWvhfyn8F1+UoAYDCx9Tuqh0VfUC9xbog/OVYcLly0ppUroNS:VdseJ3xWvhfynu1jaVcL88p/o
TLSH
T1B1D20B2B680CCB7E4F844E6DEC266F966EE801CB5B984D5487EA880C03C77EB51175DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 6b74327c05457696469543e87436aedd1f20d9ca9d5297c7def88c2afb941ac4
MD5 143cb21e42e2fe38293a9b5fc7feb91e
SHA1 5f22b0d18507ccfb30703d5e38725a9123d9b874
SHA512 f32ea15d09ad11e55eb562438f8f6882b24ea3ba1e530be3167b3e63aca65bfb2c422a22072c15d6d4d51fb6a4b070ef1a4cd52caaabfff5d53e0efc68430618
SSDEEP 48:KYHIhKggkXyV7IlKIcg/ydfIlKwswG7qfrhdD:KYH+KggmW7mKIcyGfKKws2
TLSH
T1A2913163353A02823C7D264CA2ABD63B4E4173A3741C68AF7BB904911E27E511DBC8ED
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

c17ef03f-1b0b-462f-9077-5dbc1cefc121.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\c17ef03f-1b0b-462f-9077-5dbc1cefc121.tmp
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 15KB
SHA256 787ce71e127ff36217387edb1325525d9b642c5102e355414a19ee43fa2dc3b9
MD5 ef178fc113c49a6f40166e7be6187763
SHA1 97027269e643f3b4e511a2f05734ee3b3ca701f1
SHA512 45ce8946c8d657175f2d2bf874f4cee42a8efb95642458a15f7e4f4d133b905acfede5359e09967b59cf266b18453c53772efed13565b9b2185ced9d963400ec
SSDEEP 192:uLqTSNWMsnMcPPQLz3XX9VofsN+qbGQ9CM88M7CT7WSQmiU1UqUkBOq4MTXiSCaC:3tNn/s3n9SfsNJaUCTV7RO7Cp+uR0wF1
TLSH
T174626D32AC789C7BADA7A585F54A37075FB8416796C42F84E5EC7F0D00DE25C1307A1A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 15KB
SHA256 c4db4528e4719cca4b94c693dac3bfbafdfea7f46720b1e88dcc28b48f9dfbf8
MD5 0bc04907a843d26734073fde276da2dd
SHA1 85d216868fbadeea6598a1f7a7cbeb33d7e9ec1a
SHA512 b14bf718ca13e9ab7621162b5e3aeef02f8b3b80d74300b2a3c61c38bdcf6967b00a546e0230a9ca0567c9c3cff49298d593bdc22be69b7ecac324ee0969f831
SSDEEP 384:3S9tNn/s3n9SJzsNJDUCTV7RO7Cp+uv0wF1:cj+9yHI+MrFF1
TLSH
T18B726C32AC689C7BADA3A584F54A33076FBC416B96C06F84E5EC7F0D00DE25C1307A1A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 15KB
SHA256 4b8ae45329851d41481e3430fd82ea2cf13aafbbb0063623a2b5ab8e8bd23fb9
MD5 d99bb3cb5df6da99405a478dbbc9ade3
SHA1 3c2d430c745c9d242de7eab7f65e1df9f528e758
SHA512 cfc54d0cb656b0d2ac6187a51ea60068252c76e2db112dca1a7b4917414b849d744706f4711860b4ff0d8e68b963e8b2c07acee35b5818a8d5f59d68af23ec87
SSDEEP 384:fjtNn/s3n9SfsNJDUCTV7RO7Cp+uR0wF1:Lj+9UHI+MNFF1
TLSH
T1EE626D72AC789C7BADA7A584F54A37076FB8416B96C42F84E5EC7F0D00DE25C1307A1A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 a5035d3a8d3f0ad114b425735035645897e0d4750d4109798a6e68197e2d7a33
MD5 310ac09a015bb61e1177abcc2a74dae5
SHA1 e7f7775f60e728d10ee7719b0237643a5696042a
SHA512 6d2d2c327aa3868f928a44734f342102b89a4cf2df8e2eac5cf4658eb7aa6d86212d9ac8c69b926f0717ca61ad53a0afdb8dbd6b51f2adb0918ee530ab1c9528
SSDEEP 192:lONB6vMtPQmiUyUPU8ThTXiSCV847DWsU/u:lONB6UtRpTa1rU/u
TLSH
T1E502F835AC786C7BEAA7AE45F48A23172FB4207BA5D05B50EAE82F1C00D765C1303927
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 17KB
SHA256 aca6a0583b7edd222916dde41d161450359549e8515d47c76b383af63ed15c2b
MD5 41426db5290796fafcf852b1c3f878d3
SHA1 4c6eceb61ef7260b1f75c5dff0db161d8c1ffc04
SHA512 1bb2419adf97f582ab30859dd18968520701d719bdbdacb5cf1f42fe3f221cdde1a0cca661f7dc3326b87d2db4cf28e47f8ea0eb94a99b8f441ed7c74daad641
SSDEEP 384:3KiF1tNn/s3n9SJzsNr8TUNTUlIlDUCTV7RO7Cp+ud0wF1:xF1j+9y2wg+I+MJFF1
TLSH
T177822B739C98CD7FADA7AA84F54A33075FB841A796C0AA94E6DC6F0D00DB19C1307E19
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 9KB
SHA256 a0123551ce247c051672583eff5020f96784957a760bb38f13e4b580a9cce41e
MD5 b32dfeab666a6069ab86c13e8381a665
SHA1 79d73d84df20fcad390cf0c74a31915c35cf4fa6
SHA512 3c778f08bd31e27d6d04733ac8034ff3987e576367f3b5a30bfbbd8c1d8285cb235bedac103b52385f01a248685ecba472caa75458bc292eb19c04b324e8bc6c
SSDEEP 192:OoONiX6vMdWPQmiUyUlU8OHhTXiSCaS0u280IDjqJwU/u:5ONk6UARnea+uv0wU/u
TLSH
T1F9120A72AC689C6BADA3B541F48A33471FB4916BDAC49B50EADC3F1C01DF55C1307916
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\metadata.json
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 467bcf53804bf91b2729af10782351569b51ea5f72e35c2b22a34274bfb8248b
MD5 307f390fb816d9186e86d072b760c06f
SHA1 0d3f443970f051a97c7d751a34d7ecc912f68428
SHA512 df56a2b7c1e965b7d8cb3d71f5fc9c6dc87fe85e47422a4a19496ee7e17e549891f3da4946409e9fc16c1b819909ebb97d2dd4002531519a4790bc84dcfcfd9a
TLSH
T17641185DA6F91149B3B36F56ABF7A96D887EBD372E07D45E10110D8F0A23A00C862737
MD5 SHA1 SHA512 TLSH

Submit Download