hxxps://www[.]dex[.]com/dex/ot?cid=13929493&c=132528&key=fa12-bf32-ef96-be35-ce54

Analysis

user interaction
yes
max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
23/07/2026, 02:45

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://www.dex.com/dex/ot?cid=13929493&c=132528&key=fa12-bf32-ef96-be35-ce54
Sample260723-c8tspafe39

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4980	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134292483250663944"	msedge.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1074038928-2032447174-945360078-1000\{0E4617FE-D812-4574-A74E-190E32765CA2}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4316	msedge.exe
4316	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
2792	msedge.exe
2792	msedge.exe
2792	msedge.exe
2792	msedge.exe
2792	msedge.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
2792	msedge.exe
2792	msedge.exe
2792	msedge.exe
2792	msedge.exe
2792	msedge.exe
2792	msedge.exe
2792	msedge.exe
2792	msedge.exe
2792	msedge.exe
2792	msedge.exe
2792	msedge.exe
2792	msedge.exe
2792	msedge.exe
2792	msedge.exe
2792	msedge.exe
2792	msedge.exe
2792	msedge.exe
2792	msedge.exe
2792	msedge.exe
2792	msedge.exe
2792	msedge.exe
2792	msedge.exe
2792	msedge.exe
2792	msedge.exe
2792	msedge.exe
2792	msedge.exe
2792	msedge.exe
2792	msedge.exe
2792	msedge.exe
2792	msedge.exe
2792	msedge.exe
2792	msedge.exe
2792	msedge.exe
2792	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
2792	msedge.exe
2792	msedge.exe
2792	msedge.exe
2792	msedge.exe
2792	msedge.exe
2792	msedge.exe
2792	msedge.exe
2792	msedge.exe
2792	msedge.exe
2792	msedge.exe
2792	msedge.exe
2792	msedge.exe
2792	msedge.exe
2792	msedge.exe
2792	msedge.exe
2792	msedge.exe
2792	msedge.exe
2792	msedge.exe
2792	msedge.exe
2792	msedge.exe
2792	msedge.exe
2792	msedge.exe
2792	msedge.exe
2792	msedge.exe
2792	msedge.exe
2792	msedge.exe
2792	msedge.exe
2792	msedge.exe
2792	msedge.exe
2792	msedge.exe
2792	msedge.exe
2792	msedge.exe

Suspicious use of WriteProcessMemory 34 IoCs

description	pid	Process	procid_target
PID 2792 wrote to memory of 4424	2792	msedge.exe	85
PID 2792 wrote to memory of 4980	2792	msedge.exe	86
PID 2792 wrote to memory of 1960	2792	msedge.exe	87
PID 2792 wrote to memory of 1960	2792	msedge.exe	87
PID 2792 wrote to memory of 1960	2792	msedge.exe	87
PID 2792 wrote to memory of 4888	2792	msedge.exe	88
PID 2792 wrote to memory of 4888	2792	msedge.exe	88
PID 2792 wrote to memory of 4928	2792	msedge.exe	90
PID 2792 wrote to memory of 4928	2792	msedge.exe	90
PID 2792 wrote to memory of 4700	2792	msedge.exe	91
PID 2792 wrote to memory of 4928	2792	msedge.exe	90
PID 2792 wrote to memory of 4700	2792	msedge.exe	91
PID 2792 wrote to memory of 4700	2792	msedge.exe	91
PID 2792 wrote to memory of 4472	2792	msedge.exe	92
PID 2792 wrote to memory of 4720	2792	msedge.exe	93
PID 2792 wrote to memory of 4472	2792	msedge.exe	92
PID 2792 wrote to memory of 4472	2792	msedge.exe	92
PID 2792 wrote to memory of 4720	2792	msedge.exe	93
PID 2792 wrote to memory of 4720	2792	msedge.exe	93
PID 2792 wrote to memory of 2860	2792	msedge.exe	98
PID 2792 wrote to memory of 1548	2792	msedge.exe	97
PID 2792 wrote to memory of 2860	2792	msedge.exe	98
PID 2792 wrote to memory of 1548	2792	msedge.exe	97
PID 2792 wrote to memory of 5108	2792	msedge.exe	100
PID 2792 wrote to memory of 5004	2792	msedge.exe	115
PID 2792 wrote to memory of 2308	2792	msedge.exe	116
PID 2792 wrote to memory of 4844	2792	msedge.exe	117
PID 2792 wrote to memory of 948	2792	msedge.exe	120
PID 2792 wrote to memory of 948	2792	msedge.exe	120
PID 2792 wrote to memory of 2296	2792	msedge.exe	121
PID 2792 wrote to memory of 2296	2792	msedge.exe	121
PID 2792 wrote to memory of 2664	2792	msedge.exe	123
PID 2792 wrote to memory of 2664	2792	msedge.exe	123
PID 2792 wrote to memory of 4316	2792	msedge.exe	130

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://www.dex.com/dex/ot?cid=13929493&c=132528&key=fa12-bf32-ef96-be35-ce54
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2792
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x210,0x254,0x7ff929a2c188,0x7ff929a2c194,0x7ff929a2c1a0
  2⤵
  PID:4424
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1936,i,4460788859101978181,17918001911824542056,524288 --field-trial-handle=2320,i,7700636766683606642,14634055298661047142,262144 --variations-seed-version --mojo-platform-channel-handle=2348 /prefetch:3
  2⤵
  - System Time Discovery
  PID:4980
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1652,i,12321051531718646002,10945438435187631418,262144 --field-trial-handle=2320,i,7700636766683606642,14634055298661047142,262144 --variations-seed-version --mojo-platform-channel-handle=2316 /prefetch:2
  2⤵
  PID:1960
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2484,i,15981130288027341790,3300552150325641316,524288 --field-trial-handle=2320,i,7700636766683606642,14634055298661047142,262144 --variations-seed-version --mojo-platform-channel-handle=2716 /prefetch:8
  2⤵
  PID:4888
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3476,i,11392191063209058164,10307678295072674003,2097152 --field-trial-handle=2320,i,7700636766683606642,14634055298661047142,262144 --variations-seed-version --mojo-platform-channel-handle=3484 /prefetch:1
  2⤵
  PID:4928
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3488,i,1460502715242494255,906391080430388023,2097152 --field-trial-handle=2320,i,7700636766683606642,14634055298661047142,262144 --variations-seed-version --mojo-platform-channel-handle=3708 /prefetch:1
  2⤵
  PID:4700
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4232,i,17135462055317357401,16218908529665749046,2097152 --field-trial-handle=2320,i,7700636766683606642,14634055298661047142,262144 --variations-seed-version --mojo-platform-channel-handle=4244 /prefetch:1
  2⤵
  PID:4472
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4304,i,8735074606029626259,2831019722058902302,2097152 --field-trial-handle=2320,i,7700636766683606642,14634055298661047142,262144 --variations-seed-version --mojo-platform-channel-handle=4268 /prefetch:2
  2⤵
  PID:4720
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5132,i,1640663305461657167,9996037957162100955,524288 --field-trial-handle=2320,i,7700636766683606642,14634055298661047142,262144 --variations-seed-version --mojo-platform-channel-handle=5172 /prefetch:8
  2⤵
  PID:1548
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5136,i,9078409764503214292,11257281534753358405,524288 --field-trial-handle=2320,i,7700636766683606642,14634055298661047142,262144 --variations-seed-version --mojo-platform-channel-handle=5208 /prefetch:8
  2⤵
  PID:2860
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5892,i,3144798488476500273,862964772490822732,524288 --field-trial-handle=2320,i,7700636766683606642,14634055298661047142,262144 --variations-seed-version --mojo-platform-channel-handle=5884 /prefetch:8
  2⤵
  PID:1836
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5892,i,3144798488476500273,862964772490822732,524288 --field-trial-handle=2320,i,7700636766683606642,14634055298661047142,262144 --variations-seed-version --mojo-platform-channel-handle=5884 /prefetch:8
  2⤵
  PID:5108
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4280,i,12286189941984823704,4420443871165336061,524288 --field-trial-handle=2320,i,7700636766683606642,14634055298661047142,262144 --variations-seed-version --mojo-platform-channel-handle=4272 /prefetch:8
  2⤵
  PID:5004
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4260,i,10131626727525889972,18229084244579605641,524288 --field-trial-handle=2320,i,7700636766683606642,14634055298661047142,262144 --variations-seed-version --mojo-platform-channel-handle=4292 /prefetch:8
  2⤵
  PID:2308
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4564,i,4855539418263533943,16366087309752431771,524288 --field-trial-handle=2320,i,7700636766683606642,14634055298661047142,262144 --variations-seed-version --mojo-platform-channel-handle=4508 /prefetch:8
  2⤵
  PID:4844
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5144,i,12814866792768918146,6208061192103798088,524288 --field-trial-handle=2320,i,7700636766683606642,14634055298661047142,262144 --variations-seed-version --mojo-platform-channel-handle=5736 /prefetch:8
  2⤵
  PID:948
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6536,i,10131165341622460133,2223142771250868930,524288 --field-trial-handle=2320,i,7700636766683606642,14634055298661047142,262144 --variations-seed-version --mojo-platform-channel-handle=5868 /prefetch:8
  2⤵
  PID:2296
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5208,i,13724228071435584852,16418780339737618553,524288 --field-trial-handle=2320,i,7700636766683606642,14634055298661047142,262144 --variations-seed-version --mojo-platform-channel-handle=5204 /prefetch:8
  2⤵
  PID:2664
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6632,i,9770976071845030020,17592164834767511402,262144 --field-trial-handle=2320,i,7700636766683606642,14634055298661047142,262144 --variations-seed-version --mojo-platform-channel-handle=6136 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4316

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:2076

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

blocklist

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\blocklist
Size 105KB
SHA256 8bd193269cbc0101b18807144d6cd741576381f849ecee6df4fd3079b1e2a2ea
MD5 7f4cc8bd47cae9e9cfcbdc3a9dea31d4
SHA1 6406135db9fdcf767dc9e78333ef0cb8dfd551a1
SHA512 894acd81265a2f42a77360eaacfcdb7e50c7d9b0a2718871318cc1ab538e27cb24b8d3dba4cdc1a6de030a8f0012aac3b2f7e8fbaaf939ef83c5f7ce1469a61f
SSDEEP 1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P7S:fwUQC5VwBIiElEd2K57P7S
TLSH
T1A2B3B931457E36BF26E93EE828CF1511B84F3912664895D4ABE1FE2C4845E68633CEF4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 85da5d101c008762046da9670ca95944217bbb1829e60a748f367ee4f9926b13
MD5 ef105d8d3e87a813544857290c28833d
SHA1 bfe7010cf80fb8cbcb9eeb5e0d0b551ece0b3134
SHA512 ae71c302652e2de890fca25723381f403f4f9ee51e2da6583977318de3e7ff00defb73b202e17a287def3ff618de86c0af96c0fca7729ef3efe0a4ba3cfdfc63
TLSH
T16FD0803377C9A100F6567375F413C7412F27057415868613A168C45CDC784C557C92C7
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 98eae6fcc56d922689f3a45ab65635857e6510c437555d4eae3a6cd68dff3acb
MD5 338a3c92e96cad1510815c958fc76de7
SHA1 e1234ace09aad728f9bde0798e2fb22ee82583de
SHA512 e29c9087bb4c9c94c8525a95c307117f14827336de29aa01f837bd02b05b3aecd1c1771970519a60972a1495e05b4f68ab34cf5e4ec9d7060f6383ac019c2ed7
TLSH
T17DD0803337C9A500F6567375F412C7412F2705741586C713A168C45CDC794C557C92C7
MD5 SHA1 SHA512 TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 357B
SHA256 53e0f7505a2a5dd80449c1786107b8e924c115bcf490b66e65b4938a15e38309
MD5 7370d0014c530ca12886c0df03f55a89
SHA1 926aebad06e6f2ef037a247a9b703365e295d1c1
SHA512 6c0847730dd0222d7540db9cf2dca606974fa44d9b5ab70f4654a2e2057a35f0d9c91f0aa5fa6fc49dc4e08c955aa54b59a8fc1b40a48e8b5b1a6a1f438b8fc7
TLSH
T122E02679A3F8C1F687459487CF68531D40607939D68D89BAB30CB1BC66C088C5360A88
MD5 SHA1 SHA512 TLSH

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\MANIFEST-000001
Size 158B
SHA256 9348d432e06f74d951db7f8e1614fd5c17a944bcfe3da81a90e03707060d50aa
MD5 0c322daaa89f4064e13b86d401d8f364
SHA1 3767156ca999aa0aa2ddba1717fd2a641f2ce31a
SHA512 7d9a9595bcf9d305ed1f98e30e00e9fecd5ad5b1b76ebb2c6a30cf2cfb4abc6fd1a7d96dbcf51fcf947e2af0a3a831987f34be39a13c1e7dcb5d7b0361db1455
TLSH
T12AC08059BD4C845FC28018BE5726F000176055519417D6570650FDD032407A01F2D264
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 85064c0b3acb6e6b09c1bc9edc655e54a1047a054d2bbf66e4f3c68b50f3930f
MD5 4a2486ddf7463bf7297515f0f264fab1
SHA1 c65e0383e0138061caebef741948926aa063b90c
SHA512 495c92dbba397c7ce4511e782b3381eac817adbf5f7c8238ca7f0897ecef0d7f674b1fd8a20a52e0d82c9053504a7d2c75b6b650dd13658fb0fdb944c6096a69
TLSH
T10E714C4211567C77EBDA0AF1F4CD4209B8F1CEA50E531FD5155CB8BD9827B63809AA0B
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe590016.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe590016.TMP
Size 3KB
SHA256 a3a68fcbf935fc1dc7e221594be54e2e6c87a79e84e7d346e25626769336966f
MD5 d1e777d6fa09053b546e0c81c530db54
SHA1 3c2e0242c3ce86795d814325d45b575c454147e6
SHA512 435e7ab79504a80303b5e3881a7c53e5907f565d9ff012788c7cc71e96194e699e5da30b28eedcc7c631c359f25de3971eeae25483ee5fdc83a32dd34b81ebf6
TLSH
T106715C4221567C77EBDA0AF1F4CD4209B8F1CEA50E531FD6159CF8BD9827B23809A60B
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 949B
SHA256 1f0428112385bd16d89e23259a9d657e3f4ea24cc8542b494bc1328e27bc6ce4
MD5 9819a5d12182f6ebf7c40d39802b11a0
SHA1 8c8baaa48842b3da558f0bfedc69bdfe7a3cad4b
SHA512 95d7eebbed07dc53d350dff050e14c333082fd8951661c057138ed7abdeec8ecbdb4ada6a39d725903b135c5038dd5ccb9e5a4c82ee9a243c0fa02ef9bdb69f9
TLSH
T141117DB7C3D5C5AE891116F06A24AE2BCE2E0605831C7C5989D4EF1B93E3479D10159F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 9a2576bb35688132cf97f789e1d2ee233666ab8bcd73be90585d27937856c63f
MD5 a08a08776218065e9088dfe0f971c27a
SHA1 82bf2b8471e1caae2c9c428eb6fcb93b7bc63591
SHA512 32954f51cce3a4a1d618a0ad367853615e6faef1a17eaa3b6ff6bcf7b7578a12e2ad8993dcf205c5c0488c4122aee51a1fb5e92cae25086dcb5c16627ce4ae36
SSDEEP 192:sxZYRcyM/jK1Ml8Mk//fGs6gmFIdplXHW6+WNfio/Y4SZPXRIgrJ:sxZY+M//fGs6t2JHbt/W9
TLSH
T1EB42C816AB349977CCDBD20DF955BF53D6F5057292900E84A9FC8A0C04E6AED2213C2F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 d911a817b94c70d07a3ce61602683dd5d4d0c07129f6561e0d8c0a9927573fbf
MD5 75e78530217bdc4b94fb23a0878aacaf
SHA1 29f474189f2ac9facdb86f760c332981fd4d7925
SHA512 7e6419a4e79c377b36cd1780512d45785133ae6ed1df77018e3dca3b5176419b2c1f70ba395e3e90558577b5ea4c75cf942901480b406921ec8923982bc884a7
SSDEEP 192:sxZYRcyM/jK1Ml8UQlk//fGsSgeFIdp/XHW6+WNfio/Y4tZIXRIg5IJ:sxZY+qu//fGsSp2fHbt/wm
TLSH
T1B852C716AA349977CCDBD20DFA51BF53D6F5547296900E84A9FCCA0C04E6AED221382F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 30KB
SHA256 acb03edeb73992001a78719861280c2556b8d526a0303646adb5204e6a9b3393
MD5 2a8b9424d10b4d2facdb5f984174be92
SHA1 4b86f1ac7338bc0091e68a597bf896bb21cdb86b
SHA512 5bfc6b174e20d84f2da9e968d3269643c3903f33213a9bf9e8c540d0b0e1493a771b6c1ea44b64778b8d5123e6e87ffcf977c534870d3ba5419e144447d80652
SSDEEP 768:c+8iJPNWvx76r8F1+UoAYDCx9Tuqh0VfUC9xbog/OVsALl6opdrrolkpUn5:c+8iJPNWvx76ru1jahALocdYwU5
TLSH
T1DDD20A3B680CCB7E4F844E9CEC266F966DD801CB6B948D5447FA884C03C76EA51279DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 798b01006e09ad2573b1905d12acb1ff3b9a9fc289f810189704fca764079314
MD5 d0c7ff787fa837f8cbe8861053db28d7
SHA1 7650f35b8b65c247cc8b1fca07d3bfb48647630e
SHA512 3b10f142d0f5c58cc74d192d12de2a3239003c3236b6acfdeb813a7da421a767f5d3649271be83186a00eaacf31790f0eea84e8f9f6b1a7423c05393af22edfe
SSDEEP 96:KgvmbPVdd+PtklFv+K9LFR+p3v8B/fs4AKdGmeMKnqyH:DvmbPVddItkfvvLFRU3v8B/fpevH
TLSH
T1C291661233BB42422D3F2904E66287579B9271A73408E52F376E01714F6AE660DFDDDD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig~RFe599d21.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig~RFe599d21.TMP
Size 3KB
SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
MD5 904e6e94a1d46374c8630cfd86cc729f
SHA1 e1d9c3f7813878acc6510d48d95b2bf48b2e1a0d
SHA512 081e2a26252860ff8d8f7a9d0378ae56f0cc50574d13d2a121afdf74284963747ef874a4d73b1df7774cd8570972f4f513eefe0a0325fd088556d5b1ba946712
TLSH
T1DB815C4FCC0CBE77ABAB6A719A35D6B2F79131EA94518A977F8C444EE3050ED0242E50
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 12KB
SHA256 11d37ffc1e0b385c8c5afe56e7b294cfb7bc3d4de10543c0abd6584dd7288f49
MD5 38ff5f3329336b8506036346db8c2411
SHA1 f917a0e55deb2ec766384feac393693e9483a38f
SHA512 a0cde189e8156dfa1674f8244e1b96338d389ef4ed825f31a31dbc0071768b5627691e67a56a105f9836c8db98349c77f77b761c4b35ebcc988ed11fff4c67e7
SSDEEP 192:ulLsNDWPQHemi2QmiU1BI14k03M6NkoLI/q1I:CsND8yLR0qkBgklqI
TLSH
T179423A3668786C7A9DE3E586F14637279EB981A7D7C83FD4D5EC5B0C00DA29C130B826
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 92c2037865159bcf315210568bb88f5a1a91d48a184fbf4c461cb2a6f2181e1b
MD5 12534b78bf992c1b906e7765484621e0
SHA1 4f9fa3904b21d6264629ee7332b8368e142e5e26
SHA512 1644dde085fdeebb5d7a84734e42b74a07ff0db63fa2fd2a1bc1fdf28b8722ccca11bfebc451febddb47236ec7f8e4ea5209729924a839d7142611a6a41b97ea
SSDEEP 96:ZqONkWQsjpfmUTmDK5ih/cIPURHl8h4otop5o5DJBhPwivh50xy0SFYK+AxADqQT:gONS6kDfQmiUy6PZ903SQi+FjU6
TLSH
T14B02E83968782CAB9EE3AE45F48737276FE5212BEAC52FD4D5E81A0C40D724C1306937
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 20KB
SHA256 552c02868cd4334c5ae677b27cd80daee585984b0c10d43399bb73f96a550d4f
MD5 3b85932d3fb0f04d88698f87da2690ee
SHA1 af61165b09fb1e223d72faffd37d3ed092e7af62
SHA512 6d7b1e86a71d430fcf0f5a284be9699eaec12adf22d03fdcb8301224dc0088b2c0f8b03469c8f2d3ecbee0355b7d76a13803120990ed6f8019e5557b01873931
SSDEEP 384:1ZcIhsNDJyLR0qkBgklqOObjI9G6w7maAE:NhYvq29MrJ
TLSH
T1BA928D326C78593A9AF7E551F48636275EF9C16BD7CC2F84E4ECAB0C04EA59C0307812
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 27KB
SHA256 a2b82ee3ac8d69534940bfa4ce143e0fab90a1ba889697e4f279acd12bc3adf5
MD5 d5de76621a0665aca382244a8c2f28f2
SHA1 3826ad8b244f0c6592b2a8dd698b0ddc621809c6
SHA512 4e18258a7c4b21277d4b28e387c718eed82cfc054cf90dfff2215d97fae456ce55b73f901f9462bc307033b20b38a3e12ec2a33f198a3311b7e5b1c27c645021
SSDEEP 384:biFiZcI8zsNd8TUNTUlIlJyLR+qkBgkIqOObjI9G6w7maAE:2FQA8wgHuq29MrJ
TLSH
T175D219F248E7853AD9AE9B43B77D2D174DBDC167B6886A84B3C8560CCC961BFC306811
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 b6740425c51e350b4398f70ed163a0091fa223a5e249def0d7c99ef94b06f25e
MD5 298f7a5975f5b9af94a8e10c174bff17
SHA1 f4d29f081b3cea2b4ffa6b831fd94cc8a4749f55
SHA512 2a55d88b64d62d3cbead79f830effba71fa07f23205e58da506544d5cfd5426860a896f0c3c8220049c20e4bd62feb521675c437a7908ce66ccd4c9c6ca5e3c4
SSDEEP 96:CqONkiQsjpfmUTEK5ih/cIPURHl8h4otop5oFDJBMPwivh50xy0SFYK+AxADERxO:5ONG6klQmiUycP2903M6NkMcR/q1U6
TLSH
T164120A3668B8686B5DE3A945F48736175EA58227EBC97F90D5DC1A0C04EF39C130B922
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

3708e4ef-5b3e-45b6-a4af-e6a7b703df11.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\3708e4ef-5b3e-45b6-a4af-e6a7b703df11.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 5bd56159da4f2b32a430480a954953e07ecbc631e12169237d921881e39aff25
MD5 93452b4ee017945c573603c104738c4d
SHA1 70a0a8b1c7c8d316a3c3360e61e15661847a89f8
SHA512 350312c87b6ceafccdbb948447628776e8767ab17d043e463dd5eee7aeefe7e29e3173e66dd26a5b8674c0324824fbd26b4273f6562c45c4a3bb5ddea0f241c8
TLSH
T15741285CB7FE1108B3B76F56AFF6A8AD447AB8772E0AD95E10010D4E0A72A00C871737
MD5 SHA1 SHA512 TLSH

Submit Download