9ea0aeafd3384b5256708bc3338603a6c00536e500ad67f68be9c2ce505ca9de

Analysis

max time kernel
148s
max time network
136s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
16/07/2026, 12:19

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
websitess/web-5-ka/index.html
Size 22KB
Sample260716-phpr9sc13p
SHA256 9ea0aeafd3384b5256708bc3338603a6c00536e500ad67f68be9c2ce505ca9de
MD5 38a9e1b235714f106b8c66fab1eee9a2
SHA1 830c54e00da0b1d5bc20cfda9d9de707c6e2a389
SHA512 8932835b9f4f19afbe97572625de0be7d9b7ff6e4fff43d5d33aece36207e79dcf12f3a333ef0f0e59c02f064504dd4e2965ff9a666a14c9d15bd42d56907161
SSDEEP 384:fiIZXrgv4DOySMQSz+4Ntlzun9AholAMi:6IZXr41S3Cn9Ahr
TLSH
T1A7B2C41DB906006881B3B369AFB7631CF7675223960346253EEC83824F79A5685A3FDC
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4632	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134286780090866933"	msedge.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-876885714-46325919-1482798410-1000\{E5E15929-B80C-42A7-8C73-0D9859CBAEF6}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4436	msedge.exe
4436	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
1664	msedge.exe
1664	msedge.exe
1664	msedge.exe
1664	msedge.exe
1664	msedge.exe
1664	msedge.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
1664	msedge.exe
1664	msedge.exe
1664	msedge.exe
1664	msedge.exe
1664	msedge.exe
1664	msedge.exe
1664	msedge.exe
1664	msedge.exe
1664	msedge.exe
1664	msedge.exe
1664	msedge.exe
1664	msedge.exe
1664	msedge.exe
1664	msedge.exe
1664	msedge.exe
1664	msedge.exe
1664	msedge.exe
1664	msedge.exe
1664	msedge.exe
1664	msedge.exe
1664	msedge.exe
1664	msedge.exe
1664	msedge.exe
1664	msedge.exe
1664	msedge.exe
1664	msedge.exe
1664	msedge.exe
1664	msedge.exe
1664	msedge.exe
1664	msedge.exe
1664	msedge.exe
1664	msedge.exe
1664	msedge.exe
1664	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
1664	msedge.exe
1664	msedge.exe
1664	msedge.exe
1664	msedge.exe
1664	msedge.exe
1664	msedge.exe
1664	msedge.exe
1664	msedge.exe
1664	msedge.exe
1664	msedge.exe
1664	msedge.exe
1664	msedge.exe
1664	msedge.exe
1664	msedge.exe
1664	msedge.exe
1664	msedge.exe
1664	msedge.exe
1664	msedge.exe
1664	msedge.exe
1664	msedge.exe
1664	msedge.exe
1664	msedge.exe
1664	msedge.exe
1664	msedge.exe
1664	msedge.exe
1664	msedge.exe
1664	msedge.exe
1664	msedge.exe
1664	msedge.exe
1664	msedge.exe
1664	msedge.exe
1664	msedge.exe

Suspicious use of WriteProcessMemory 35 IoCs

description	pid	Process	procid_target
PID 1664 wrote to memory of 3304	1664	msedge.exe	85
PID 1664 wrote to memory of 4132	1664	msedge.exe	86
PID 1664 wrote to memory of 4632	1664	msedge.exe	87
PID 1664 wrote to memory of 4132	1664	msedge.exe	86
PID 1664 wrote to memory of 4132	1664	msedge.exe	86
PID 1664 wrote to memory of 4532	1664	msedge.exe	89
PID 1664 wrote to memory of 4532	1664	msedge.exe	89
PID 1664 wrote to memory of 696	1664	msedge.exe	91
PID 1664 wrote to memory of 696	1664	msedge.exe	91
PID 1664 wrote to memory of 696	1664	msedge.exe	91
PID 1664 wrote to memory of 2188	1664	msedge.exe	90
PID 1664 wrote to memory of 2188	1664	msedge.exe	90
PID 1664 wrote to memory of 2188	1664	msedge.exe	90
PID 1664 wrote to memory of 4772	1664	msedge.exe	93
PID 1664 wrote to memory of 2360	1664	msedge.exe	92
PID 1664 wrote to memory of 4772	1664	msedge.exe	93
PID 1664 wrote to memory of 4772	1664	msedge.exe	93
PID 1664 wrote to memory of 2360	1664	msedge.exe	92
PID 1664 wrote to memory of 2360	1664	msedge.exe	92
PID 1664 wrote to memory of 2712	1664	msedge.exe	98
PID 1664 wrote to memory of 2712	1664	msedge.exe	98
PID 1664 wrote to memory of 4936	1664	msedge.exe	99
PID 1664 wrote to memory of 4936	1664	msedge.exe	99
PID 1664 wrote to memory of 2948	1664	msedge.exe	101
PID 1664 wrote to memory of 2104	1664	msedge.exe	102
PID 1664 wrote to memory of 2104	1664	msedge.exe	102
PID 1664 wrote to memory of 2104	1664	msedge.exe	102
PID 1664 wrote to memory of 1904	1664	msedge.exe	105
PID 1664 wrote to memory of 532	1664	msedge.exe	106
PID 1664 wrote to memory of 1976	1664	msedge.exe	107
PID 1664 wrote to memory of 2212	1664	msedge.exe	114
PID 1664 wrote to memory of 2212	1664	msedge.exe	114
PID 1664 wrote to memory of 1720	1664	msedge.exe	115
PID 1664 wrote to memory of 1720	1664	msedge.exe	115
PID 1664 wrote to memory of 4436	1664	msedge.exe	117

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument C:\Users\Admin\AppData\Local\Temp\websitess\web-5-ka\index.html
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1664
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x218,0x2f0,0x7ff8924dc188,0x7ff8924dc194,0x7ff8924dc1a0
  2⤵
  PID:3304
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1888,i,399795794888726301,4373390162562806987,262144 --field-trial-handle=2276,i,13128720496487503347,9800361403949390467,262144 --variations-seed-version --mojo-platform-channel-handle=2272 /prefetch:2
  2⤵
  PID:4132
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2024,i,7172972378146423742,5732430718103089875,524288 --field-trial-handle=2276,i,13128720496487503347,9800361403949390467,262144 --variations-seed-version --mojo-platform-channel-handle=2320 /prefetch:3
  2⤵
  - System Time Discovery
  PID:4632
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1972,i,2150721382355470277,14130977397746040930,524288 --field-trial-handle=2276,i,13128720496487503347,9800361403949390467,262144 --variations-seed-version --mojo-platform-channel-handle=3148 /prefetch:8
  2⤵
  PID:4532
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3484,i,956987417875696764,1159016558863123335,2097152 --field-trial-handle=2276,i,13128720496487503347,9800361403949390467,262144 --variations-seed-version --mojo-platform-channel-handle=3536 /prefetch:1
  2⤵
  PID:2188
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3488,i,9343014189619235025,12014370657734590089,2097152 --field-trial-handle=2276,i,13128720496487503347,9800361403949390467,262144 --variations-seed-version --mojo-platform-channel-handle=3572 /prefetch:1
  2⤵
  PID:696
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4196,i,1551419416455253035,11180624755968888224,2097152 --field-trial-handle=2276,i,13128720496487503347,9800361403949390467,262144 --variations-seed-version --mojo-platform-channel-handle=4308 /prefetch:2
  2⤵
  PID:2360
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4148,i,14626782052697289563,1406937180347554218,2097152 --field-trial-handle=2276,i,13128720496487503347,9800361403949390467,262144 --variations-seed-version --mojo-platform-channel-handle=4256 /prefetch:1
  2⤵
  PID:4772
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5160,i,17886028330202350569,1088861844558829307,524288 --field-trial-handle=2276,i,13128720496487503347,9800361403949390467,262144 --variations-seed-version --mojo-platform-channel-handle=5220 /prefetch:8
  2⤵
  PID:2712
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5148,i,7293973763044131655,607267980425148771,524288 --field-trial-handle=2276,i,13128720496487503347,9800361403949390467,262144 --variations-seed-version --mojo-platform-channel-handle=5252 /prefetch:8
  2⤵
  PID:4936
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5908,i,17336733829783000779,5036530280312904833,524288 --field-trial-handle=2276,i,13128720496487503347,9800361403949390467,262144 --variations-seed-version --mojo-platform-channel-handle=5924 /prefetch:8
  2⤵
  PID:5040
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5908,i,17336733829783000779,5036530280312904833,524288 --field-trial-handle=2276,i,13128720496487503347,9800361403949390467,262144 --variations-seed-version --mojo-platform-channel-handle=5924 /prefetch:8
  2⤵
  PID:2948
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --always-read-main-dll --metrics-shmem-handle=6172,i,4391495989760289509,15207630814772645091,2097152 --field-trial-handle=2276,i,13128720496487503347,9800361403949390467,262144 --variations-seed-version --mojo-platform-channel-handle=6196 /prefetch:1
  2⤵
  PID:2104
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5992,i,9860174557372616267,3847347238888101489,524288 --field-trial-handle=2276,i,13128720496487503347,9800361403949390467,262144 --variations-seed-version --mojo-platform-channel-handle=5016 /prefetch:8
  2⤵
  PID:1904
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5744,i,17078721097576504899,4252024996536829626,524288 --field-trial-handle=2276,i,13128720496487503347,9800361403949390467,262144 --variations-seed-version --mojo-platform-channel-handle=5984 /prefetch:8
  2⤵
  PID:532
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5892,i,6540666167700784157,5933501030854621558,524288 --field-trial-handle=2276,i,13128720496487503347,9800361403949390467,262144 --variations-seed-version --mojo-platform-channel-handle=4256 /prefetch:8
  2⤵
  PID:1976
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5252,i,8664336967974504920,7871829134205468439,524288 --field-trial-handle=2276,i,13128720496487503347,9800361403949390467,262144 --variations-seed-version --mojo-platform-channel-handle=4164 /prefetch:8
  2⤵
  PID:2212
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6432,i,14697675823242171704,1239052882884265396,524288 --field-trial-handle=2276,i,13128720496487503347,9800361403949390467,262144 --variations-seed-version --mojo-platform-channel-handle=5820 /prefetch:8
  2⤵
  PID:1720
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=748,i,1786738394549236834,8876769820610490730,262144 --field-trial-handle=2276,i,13128720496487503347,9800361403949390467,262144 --variations-seed-version --mojo-platform-channel-handle=6080 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4436

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:3360

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

blocklist

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\blocklist
Size 105KB
SHA256 994380ffd288a5f1a9acc9eb76a487a55b12cc1daec839d811240f6cbdc4da3a
MD5 f5ed4946834be586ac6410ed88740a7c
SHA1 6108ce368e8b3bb8012956bb25606c3b16835c7b
SHA512 76bf60b37c50422ab125edd3da70629e685408a106655a9b7e5cb6aa7b6a9000c76d8ac2f5dc85e58e893b61bef9b539b9488ac894f1fc1338a58944dc9f4711
SSDEEP 1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P77:fwUQC5VwBIiElEd2K57P77
TLSH
T1E5B3B931457E36BF26E93EE828CF1511B84F3912664895D4ABE1FE2C4845E68633CEF4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 6de34b260036ecaa4ce5839bc4a7ff7495e50b7b94349b12d9f840ca0e76da3b
MD5 56d82099872fb501c566d072ae897035
SHA1 2c96501551fc13c09496780960d8e7ccb4957b77
SHA512 c4b4017256caf25e88f146e6104134cddfd15089203e8e74c5196627fc92897f9fe7e3fc5c8305032be88e9409cdbc5dfe1e81017fcd5e38b3579b3d823b4a41
TLSH
T160D0C073378C7C00EA090170D013C3031FA7855824C39F03B100C01C54B43D9738B093
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 f5dece638cd89af82b06bd2fcb3d1738eef64d2275be237184ea8bff7af3fdfa
MD5 f19ec2293392af872f10929c41627e26
SHA1 0576f5277c470f5bb8c3f4d3786ca8d967d0a33e
SHA512 4cc85dc71d34bb516f8fe45b565a6a9b4cda255a931f33289247ed84150baf0e2df40fc87109df41771553b92545ed858197cdd3d673694c83458cf9812aa9dd
TLSH
T16CD02272268C6C00EA090170D01383021EA6855824839B03A100C01C44A52D9728A093
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 616b7d64c979e7b44654eaa77a7f63470cca5b4b3c380f29a10a177b88f5cc85
MD5 8c4ff530f28884c6f509f4448ff20dcc
SHA1 13e71a29d9892628391e38f719f1f3f931231c55
SHA512 53cc29fb3fee3213365cf4f206f85cf02fff394874a4e725aae4a8f20036666ed93a87a8e63ee24c33331df5832f3c22510111c6fe2fc48193abafdf39624325
TLSH
T1857192D4F1758896E3A2837DD6E1C625343497AB0B8FDD470660863DE50FBE343AE108
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe59069d.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe59069d.TMP
Size 3KB
SHA256 01817387c004f57c73aba4673d54179c6ce10f133e8ab9818e97e4a1e7ac9f80
MD5 4c946b99da3411e519665fbac6d7b1f3
SHA1 eb5225f5c550866648745f8fd789c2e415cb1b00
SHA512 a7512da406e08b8ffb77c513277d1db5d1708630eccb5450f60da945cad3c6f68cf894b931caf7e439af4f6420648cec5845b549268a07519db9aba5718b2c87
TLSH
T16171A3D4F1759896D3A2837DC6E1C624343497AB0B8FDD470660463DE50FBE343AE118
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 694B
SHA256 5d634807c88b047fc3d9d48b08b87c07449b5afeb4322bcc419895ef65309964
MD5 8341c51b479ac90e49a82546dacc4785
SHA1 6ea133adf72e9896476a68bec4bf874855d3bc18
SHA512 d32a1aba385cd13f3e58c99726b17d96c1a2f8c9b5120cdf12fe66115ec49abec6e6f59322ba0f4412a38ec80c418ca9206b7be012373e7eca34c71bc60d53e2
TLSH
T11F017BF3C7E595AE891112F06A28EE1BCE2D0506421C7D598AE4FF2BD3E3069E00295B
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 17ea89649b233d58ef70201e05aa752f44a68736f6f023a9a7f823a456fb1ed8
MD5 316bfe95b97626e9d71c74a4abb1c492
SHA1 5652fd555973141711b4564d23bd6cffc0e039ad
SHA512 4ef51f0bfff9913f50cc4745ca0df0da4ad2467da1f6391ff48043a2e65c577d49b77f6895cd4ce3da14252e7401eb7e1b2b02e7278a8c799147af92c7a3983f
SSDEEP 192:sxZUIM/yM/jK1Ml8MkZE/f5Zsdk/UhRIdpdUjHW6+WNGYwKU8B9tDFVMIgrJ:sxZ47Mq/frsdEHKHbGWy9
TLSH
T16642F9126B349977CCDBD209FA557F43D6F9457292900E48AAFCDA0C04E6BED221782F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 a5782e9176308e5a6316b73460395a2bc4f81b1d6330dbea7ca622d92949b4c6
MD5 4a7ec0ee40fccb3262adbac26d927d77
SHA1 110e96280a277e8aa72a7d9bcc7cdade5b7ebebe
SHA512 e05c518c40500a0676481be05667be143868536545c8342e9a7ca23e07b07da485146e100fa1d830f119b3f7a509a2ba53be6465cceb30524d74b90e332b3891
SSDEEP 192:sxZUIM/yM/jK1Ml8UQZ9kZE/f5ZsZsLAv/UhRIdpHUjHW6+WNGYwmU8i9+QDFVMo:sxZ47q4q/frsi03H0HbG2xo
TLSH
T12652F9166A345D77CCDBD209BA557F93D6F9447292900E48AAFCCB0C04E6BED221782F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 30KB
SHA256 2baa8ec602bdb51799f94db766c9bee6b35b8c01a275c18f74489d5592f98a35
MD5 28d0cf99538e928f33d5a36b2a3681ec
SHA1 bc372fb326474c40ba2cace4e7c716a6613c55d4
SHA512 f743ed11fbb46c98e4af0a92c9edbba7c32220ea746dad98de23bcb133ffa98773fb81462d01cc966874181ff9d0d71a9e4ccd24c25d75837006133a9fba3210
SSDEEP 768:5+4jeXmWvmKLE8F1+UoAYDCx9Tuqh0VfUC9xbog/OVhPLlrZ+dKroh4c1ar:5+4jeXmWvmKLEu1jacPLZQdh1m
TLSH
T1CFD20A3B240CCF7E4F844E9CED26AE976ED801CB6A584D5447FA894C03C76EB512A49B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 6129d8a16688dfeebecc6f640fc7cffbeac2876689a8ce2fcccff74cbd7a4e3a
MD5 e1f7f6bb850a99adb4c0fe22101159f4
SHA1 54c6a4684cf5230ef513c4e9f0aad2cefbd662c8
SHA512 8a0dd0f8fed373d6d3b59ed5e8f3330f5fb6864198e3a69ff0459774d380ec25363c4457c5fd05b2a159fdc79a832c4ba7e73fc21e5e08916a01eb08c54b3755
SSDEEP 96:KkHC7ntll+n1AldH+KFLdB+pfHoxXfm3uKQ4X8AKpmyx:zHC7ntll81A3HHLdBwfHoxXfVLjx
TLSH
T147916483727E42122C7D381492A8CB575A91B5733209A86B77ED41A20F2BE214DFDCFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

4c46140c-469a-40ee-90d9-911190e35204.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\4c46140c-469a-40ee-90d9-911190e35204.tmp
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 11KB
SHA256 ced9764bb649dd27dc5f5ac1fc747c5e83b0b78a31198b532b6c2e4ba5f6be28
MD5 924ec0a8ffb2cc8a3dd82aed4f55ea29
SHA1 5ae799d054df4d5e26fc245615af4275c333b68f
SHA512 944f569d7ae36edf109bf760505439310c671c4936f8935d70fbae16e933d367a8ef5b3ca0015cb7c4c88649a7d1329e9556cf328f48c5ea2455bcb14f63d750
SSDEEP 192:uksLsN+Wb8QQVx/ZECE75QmiU1UoFUoGYOs4H/+jVEBO1Tm6//EO5cFTDT4qyU8:4sNpoQ9ZzIf++BO1/chF/sU8
TLSH
T167320A3268689C771DE2A644F44B36539EF8502BDEC53FC8D6EC2B1C04CA7AC231A916
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 ce9d4214a6331e88bd5aa6c4e92810d6c84e439bc0454866beee2e6f8aecee9b
MD5 50a7fd21e599680921df7c567d71cb95
SHA1 bf05d328f6651f3a9dde865f8317640a1e4b0510
SHA512 92a23c9568f8ae6ea92e7be6bca83899fecfc3ba7388a54da1e5bd9d869de53cbba26eaf7073ecd5243157c10def9a06b338f8a9138ac1d37adc8d45ce84f883
SSDEEP 384:qiF9zsNk8TUNTUlIlh+9ZzIf++BO1/cZqF/sOObjI9G6w7DS:hFFzwgLKQTBO1/cy/s29MW
TLSH
T16A824B339898CD7B9EA29A44F49B36538EF850BBCAD57FC8E3DC5B0C058B69C1306815
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 15KB
SHA256 014f7b9a4dc3e78c61926822fa7d0f9b37c00817e13e1287a7275f4afbaee302
MD5 641143442a682c6555c9f9900e51827d
SHA1 0e163ad25708686242546c2c40c8b49d0924bb9a
SHA512 55cb74d30fcaacece64304bb51e58a3685713758c1f8cddd5fca813e352e3c3775130a0fbffc3fd8f9d7811f59383f828ad7aca4d43d488e4b88d81de31e784b
SSDEEP 384:qiF9zsNL8TUNTUlIlhw9ZzIf++BO1/cfF/s3K:hFFiwgLwQTBO1/cd/sa
TLSH
T17C62F93358988C3B6EA69A85F94B36538EF851ABCDD5BFD4E7DC5B0C009A29C1307C15
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 22KB
SHA256 159e1a8438403ab74aef768569211350e89cffd50ddf2fba4d00bc27207357f8
MD5 33aa820baa4f4867fe7b7d2eb4255178
SHA1 756f5bc5bee2acdaf3e9f9d603c00ff86094b5e0
SHA512 c01e20e4ee99e66c175931782bc6b03d1257c0b96b41aec26b41aa6325546d82c8b9b9ebb6a8245233088f002a8b8535ba8f62475753cea1d7910ccc499207a1
SSDEEP 384:qiF1tNn/s3n9SDzsNk8TUNTUlIlhg9ZzIf++BO1/cZqF/sOObjI9G6w7Dx:hF1j+9czwgLgQTBO1/cy/s29M1
TLSH
T102A26C3398588D7B5EA29E84F44B36178EF851BBCAC57EC8E7DC6F0D048B2AC1306915
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 11KB
SHA256 07b5c4809cd2fc500fb5ecbfcb9301f70b187b96a97489214013b4972cd984e7
MD5 9decbd8fadc964cd4fb1f813cf1c55cc
SHA1 b63e5ee6b9b611bcb3f155c0b69b708c432232f3
SHA512 7bfa9802281e81bcf2cf549d6c4acf0b65eddb8e43ce055edbcd65b9d18a6f76da2797061e91fb14c7139f3c952a5ba833c62055607e1041ca2a03cf3fdffead
SSDEEP 192:uZ+sLsN+WA8QQVx/ZECE75QmiU1UoFUoGYOs4H/+jVEBO1Tm6//EO5cFTDT4qyU8:0sNphQ9ZzIf++BO1/chF/sU8
TLSH
T1D2320A3268689C775DE2A684F44B36539EF8502BDEC53FC8D6EC1B1C04CA7AC231B916
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 53205aac2d710eab31b1105b88dcd8fe60dc733eb19778522e1ac27cd889dbe5
MD5 82142e044ace6180f9725013c656a684
SHA1 9a8b4cd7081c6b804dabf7e6f12dc5a98baeb7b5
SHA512 d5b3c45b98b560b7c6e776b568dbe0f5a144bd970d65203a17a0e3b7fb594e9e7348e34b1b0b4458e49b528e40b1b047926f0eb790299c96d52cbb5c8fa9e9c6
SSDEEP 192:EONI6hZ0QmiUyUo7Uovpc/+jVEBO1Tm65wOZDTzgfrU6:EONI6oMpu++BOU2/0DU6
TLSH
T11502D835686C6C778EE2AE45F48767235FE8212BEE956F88D6E81B1D00C775C2307836
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 12KB
SHA256 fc731351d353c5aa4887b603133b80891a5db37c55b0d2b0425603dc0f5abc84
MD5 3e11c07e6d4c4f7146682a2fb14a5541
SHA1 aa511bfae768efeded2afd4077e5428f9d619b45
SHA512 51dc32d6cd3d89beb6296df8d653e55ea3b62f51154591b27b037809433574e573a07e55f05c9d526d0effe1120a973d49327e6bd72a5926d40b2e09cb399260
SSDEEP 192:uZ+sLsN+WA8wQVx/ZECE75QmiU1UoFUoGYOs4H/+jVEBO1Tm6//EO5cFTDT4qy3K:0sNphw9ZzIf++BO1/chF/s3K
TLSH
T16E421A3668689C375DE2A645F84B3A538EF8506BDEC53FD8D6EC6B0C05CA79C2307816
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 36944a7fa024cbe307e2ae104834a80434e380f0a0b27163db73049fd0fe34f8
MD5 85be7f23d1cf48c641c46db715ad5a31
SHA1 3d0659d19ab667ecf0f91cd7ec1371cbc403a3a7
SHA512 13c3a1096dc88330a05b0c2673544a623a9ac99316bdc6a6be664d8f40c650f87fa8ca171d711aa7cf22810d394415c56dd5cd879eaf80a43fbf1e58a170cdbc
SSDEEP 192:O+ONiT6hZyPQmiUyUoiUovOxc/+jVEBO1Tm6//EZ5cOqDT4qyU6:bONs6+X4u++BO1/cM9/sU6
TLSH
T13912F8326868AC671DD2AA85F48736534EE8512BDEC57FC5D6EC2B1C04DF7AC230B816
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

77df8bf5-253e-44f4-980e-6cf329801d98.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\77df8bf5-253e-44f4-980e-6cf329801d98.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 1f2c8e510976cca25ecfcb037afba3044abd5b5d5e6274bd0695b6985f654c97
MD5 85001dec7383ecfae63b54e371847a34
SHA1 fe5852e2d0f630ee311f854e8ad73ca8f1ea8527
SHA512 6552009dc34aa47f80bf301e46e2a1b6da3e87598556e67356652e1ff31ac3cba7fa4531438a8fd03fc9957050df607985869faa926023b9476fa5caae673bbc
TLSH
T115411648AAF91158B3B7AF5AAFF6986D447F7C772E0A945D10110E4E0A63B40C872B37
MD5 SHA1 SHA512 TLSH

Submit Download