hxxp://zpjivmwnrhiwd[.]site

Analysis

user interaction
yes
max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
23/07/2026, 03:10

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
http://zpjivmwnrhiwd.site
Sample260723-dpafdadk91

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
3980	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134292498393405095"	msedge.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1788976790-1541110888-1636651838-1000\{DD60BA27-E38B-426E-A435-C7E335BCF76C}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2636	msedge.exe
2636	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
5000	msedge.exe
5000	msedge.exe
5000	msedge.exe
5000	msedge.exe
5000	msedge.exe
5000	msedge.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
5000	msedge.exe
5000	msedge.exe
5000	msedge.exe
5000	msedge.exe
5000	msedge.exe
5000	msedge.exe
5000	msedge.exe
5000	msedge.exe
5000	msedge.exe
5000	msedge.exe
5000	msedge.exe
5000	msedge.exe
5000	msedge.exe
5000	msedge.exe
5000	msedge.exe
5000	msedge.exe
5000	msedge.exe
5000	msedge.exe
5000	msedge.exe
5000	msedge.exe
5000	msedge.exe
5000	msedge.exe
5000	msedge.exe
5000	msedge.exe
5000	msedge.exe
5000	msedge.exe
5000	msedge.exe
5000	msedge.exe
5000	msedge.exe
5000	msedge.exe
5000	msedge.exe
5000	msedge.exe
5000	msedge.exe
5000	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
5000	msedge.exe
5000	msedge.exe
5000	msedge.exe
5000	msedge.exe
5000	msedge.exe
5000	msedge.exe
5000	msedge.exe
5000	msedge.exe
5000	msedge.exe
5000	msedge.exe
5000	msedge.exe
5000	msedge.exe
5000	msedge.exe
5000	msedge.exe
5000	msedge.exe
5000	msedge.exe
5000	msedge.exe
5000	msedge.exe
5000	msedge.exe
5000	msedge.exe
5000	msedge.exe
5000	msedge.exe
5000	msedge.exe
5000	msedge.exe
5000	msedge.exe
5000	msedge.exe
5000	msedge.exe
5000	msedge.exe
5000	msedge.exe
5000	msedge.exe
5000	msedge.exe
5000	msedge.exe

Suspicious use of WriteProcessMemory 35 IoCs

description	pid	Process	procid_target
PID 5000 wrote to memory of 2552	5000	msedge.exe	84
PID 5000 wrote to memory of 3980	5000	msedge.exe	85
PID 5000 wrote to memory of 2376	5000	msedge.exe	86
PID 5000 wrote to memory of 2376	5000	msedge.exe	86
PID 5000 wrote to memory of 2376	5000	msedge.exe	86
PID 5000 wrote to memory of 3908	5000	msedge.exe	88
PID 5000 wrote to memory of 3908	5000	msedge.exe	88
PID 5000 wrote to memory of 1560	5000	msedge.exe	89
PID 5000 wrote to memory of 1560	5000	msedge.exe	89
PID 5000 wrote to memory of 1560	5000	msedge.exe	89
PID 5000 wrote to memory of 936	5000	msedge.exe	90
PID 5000 wrote to memory of 936	5000	msedge.exe	90
PID 5000 wrote to memory of 936	5000	msedge.exe	90
PID 5000 wrote to memory of 3924	5000	msedge.exe	91
PID 5000 wrote to memory of 3924	5000	msedge.exe	91
PID 5000 wrote to memory of 3924	5000	msedge.exe	91
PID 5000 wrote to memory of 3944	5000	msedge.exe	92
PID 5000 wrote to memory of 3944	5000	msedge.exe	92
PID 5000 wrote to memory of 3944	5000	msedge.exe	92
PID 5000 wrote to memory of 3240	5000	msedge.exe	95
PID 5000 wrote to memory of 3240	5000	msedge.exe	95
PID 5000 wrote to memory of 3240	5000	msedge.exe	95
PID 5000 wrote to memory of 3032	5000	msedge.exe	102
PID 5000 wrote to memory of 1696	5000	msedge.exe	103
PID 5000 wrote to memory of 3032	5000	msedge.exe	102
PID 5000 wrote to memory of 1696	5000	msedge.exe	103
PID 5000 wrote to memory of 3392	5000	msedge.exe	106
PID 5000 wrote to memory of 1740	5000	msedge.exe	114
PID 5000 wrote to memory of 3428	5000	msedge.exe	115
PID 5000 wrote to memory of 2744	5000	msedge.exe	116
PID 5000 wrote to memory of 5108	5000	msedge.exe	119
PID 5000 wrote to memory of 5108	5000	msedge.exe	119
PID 5000 wrote to memory of 2892	5000	msedge.exe	122
PID 5000 wrote to memory of 2892	5000	msedge.exe	122
PID 5000 wrote to memory of 2636	5000	msedge.exe	126

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument http://zpjivmwnrhiwd.site
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:5000
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x260,0x7ffe0009c188,0x7ffe0009c194,0x7ffe0009c1a0
  2⤵
  PID:2552
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1784,i,8884163321619458069,7468021235206202897,524288 --field-trial-handle=2380,i,11698579188457285493,9280967108250069228,262144 --variations-seed-version --mojo-platform-channel-handle=2432 /prefetch:3
  2⤵
  - System Time Discovery
  PID:3980
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1644,i,4289190204166224857,134885562910322425,262144 --field-trial-handle=2380,i,11698579188457285493,9280967108250069228,262144 --variations-seed-version --mojo-platform-channel-handle=2376 /prefetch:2
  2⤵
  PID:2376
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2584,i,14214272652525289200,17677643995110886244,524288 --field-trial-handle=2380,i,11698579188457285493,9280967108250069228,262144 --variations-seed-version --mojo-platform-channel-handle=2728 /prefetch:8
  2⤵
  PID:3908
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3440,i,10256102306243273804,4198801112358753841,2097152 --field-trial-handle=2380,i,11698579188457285493,9280967108250069228,262144 --variations-seed-version --mojo-platform-channel-handle=3476 /prefetch:1
  2⤵
  PID:1560
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3444,i,17120308457641405493,11198551194211348143,2097152 --field-trial-handle=2380,i,11698579188457285493,9280967108250069228,262144 --variations-seed-version --mojo-platform-channel-handle=3740 /prefetch:1
  2⤵
  PID:936
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4228,i,2929144709301366240,6879592189975084165,2097152 --field-trial-handle=2380,i,11698579188457285493,9280967108250069228,262144 --variations-seed-version --mojo-platform-channel-handle=4264 /prefetch:1
  2⤵
  PID:3924
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4260,i,8266514481662059523,10471979417519317184,2097152 --field-trial-handle=2380,i,11698579188457285493,9280967108250069228,262144 --variations-seed-version --mojo-platform-channel-handle=4284 /prefetch:2
  2⤵
  PID:3944
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=5092,i,9189414428350916994,4759885021844388337,2097152 --field-trial-handle=2380,i,11698579188457285493,9280967108250069228,262144 --variations-seed-version --mojo-platform-channel-handle=5096 /prefetch:1
  2⤵
  PID:3240
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3940,i,15142694645696718756,8841562432030047697,524288 --field-trial-handle=2380,i,11698579188457285493,9280967108250069228,262144 --variations-seed-version --mojo-platform-channel-handle=3892 /prefetch:8
  2⤵
  PID:3032
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3944,i,6364917478996614058,11254474062152569409,524288 --field-trial-handle=2380,i,11698579188457285493,9280967108250069228,262144 --variations-seed-version --mojo-platform-channel-handle=3948 /prefetch:8
  2⤵
  PID:1696
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5876,i,17095430264536284158,15500106153492642268,524288 --field-trial-handle=2380,i,11698579188457285493,9280967108250069228,262144 --variations-seed-version --mojo-platform-channel-handle=5892 /prefetch:8
  2⤵
  PID:4720
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5876,i,17095430264536284158,15500106153492642268,524288 --field-trial-handle=2380,i,11698579188457285493,9280967108250069228,262144 --variations-seed-version --mojo-platform-channel-handle=5892 /prefetch:8
  2⤵
  PID:3392
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4560,i,18336320614293691321,10111574972628406134,524288 --field-trial-handle=2380,i,11698579188457285493,9280967108250069228,262144 --variations-seed-version --mojo-platform-channel-handle=5568 /prefetch:8
  2⤵
  PID:1740
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3476,i,13807265263726792427,10103247429005984431,524288 --field-trial-handle=2380,i,11698579188457285493,9280967108250069228,262144 --variations-seed-version --mojo-platform-channel-handle=6244 /prefetch:8
  2⤵
  PID:3428
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3748,i,16817150586270942172,11404228978447242752,524288 --field-trial-handle=2380,i,11698579188457285493,9280967108250069228,262144 --variations-seed-version --mojo-platform-channel-handle=4504 /prefetch:8
  2⤵
  PID:2744
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4456,i,1885732536675437960,15177309008592533970,524288 --field-trial-handle=2380,i,11698579188457285493,9280967108250069228,262144 --variations-seed-version --mojo-platform-channel-handle=4468 /prefetch:8
  2⤵
  PID:5108
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5444,i,3956320990315774412,4901750249132031082,524288 --field-trial-handle=2380,i,11698579188457285493,9280967108250069228,262144 --variations-seed-version --mojo-platform-channel-handle=5996 /prefetch:8
  2⤵
  PID:2892
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=3912,i,9671970725332052522,5370169948774763520,262144 --field-trial-handle=2380,i,11698579188457285493,9280967108250069228,262144 --variations-seed-version --mojo-platform-channel-handle=6124 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2636

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:3288

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

blocklist

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\blocklist
Size 105KB
SHA256 deae8ba3a07225fe9f1490e4968fd83f8d308707a88a6d3d541d8ab416841ddf
MD5 1fcf11901014bf515178c91bdb7a6c5c
SHA1 4746b018067d9671617515224b7697b27fd2fc5f
SHA512 6059830103275d34e1aa4dd4e8d4177b6c2b684b2b3ad5417753387a227c838c0b258e662c78853cf649656ebd762f5d160c10349cd19ac1953380bd6572c660
SSDEEP 1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P7p:fwUQC5VwBIiElEd2K57P7p
TLSH
T16EB3B931457E36BF26E93EE828CF1511B84F3912664895D4ABE1FE2C4845E68633CEF4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 6d0f88884e23b1418c456620b79662feebdfd970ca9325ba2981c94b3b0f0b2f
MD5 7060eae8ec426d15de2849b1f7d261b4
SHA1 b252d90b9d7050d0b9b7c03141d9d3b7cae404ac
SHA512 8791005fae20dc1dc5dc5b0086efe814e0b1e36781ef1931cc1fc699fc4cb34d62ab3f9a83f4967824f3bb71aef6adc6ad457ab7a6addcba99f9e9b473eabb4d
TLSH
T118D01222BE08A415E65BA271A502C7141F5954A124938651E224D86CD9F84D49696387
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 4d517b88a0fb88494276c126764235de9ee52961c86cc4d3abaf517b10a649a8
MD5 dde9ea8dd9c7e315ef614ab3476af02c
SHA1 e03e201e89770d15b4040d579c2cce8684959a2c
SHA512 410e016336529d709de957d44e67238e4f6592b9ce6646395a9e45ce592e7810b4cb6b1b6df5d8b26875a6aa235b77d41c0983ccc055556f8b8c02224093fdd1
TLSH
T16DD012227E08A415E65BA271A502C7141F5954A124938651E224D86CC9F94D49696387
MD5 SHA1 SHA512 TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 352B
SHA256 b10ff5ae40181e17390205b17daff6498cb2ea47087d0fe2158bd7107ed8d0f7
MD5 f93c0e466d55fe19a23936fc50c23f22
SHA1 8b7c1d5d5a026027f03068d18de17529142d10ae
SHA512 e9dc919bd27728b58ed5a9784ea8d8f0caefdd962259c780b1f7bfc710a916738e310307e982d0a6259ee1c91e712996412b7d9c996c478380b3f0fd844e0ec2
TLSH
T185E0209773D6C3550381E68785585394C860F10BA58D9EF9760CE2DD38838845B658D4
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 076806a950295370f7dcb9212179c3ff944a572339823d91fd41fa9f1da73349
MD5 a7e5aa2b423863065c64600a18e6aa54
SHA1 5d778f3e5dcdab611bbd250cfd30a7dc325b291c
SHA512 d7be1d1fc3b1a2619d81451880cfd5499329219082117b0f7121a7501b53e92ffd080e1ac53fcf874f20f1ede7e16c512a73aa1dc10e93dc5b80ece9804f3f62
TLSH
T1C5714CBB07F2A8B8E3D04872A0D25541743DC2F9F807EE9AF7D085B91E1176582F8174
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe58b188.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe58b188.TMP
Size 3KB
SHA256 e1ff3e572018a1d025711ffc81a9be350cc928bc658fa96dcd96dfae0e5889db
MD5 799db45953864686a8a959d4a5e3f51f
SHA1 e7c1d428e78949ad055421125035aadbda61e2f9
SHA512 ff8795c4b761c78622d32119f881db31039f66b75961e0a2823828bfc4c0c8c83aac2715075cabd2c4f8cd2f545eff022a1247d62b5edc82ecf67501b994da76
TLSH
T16F714CBB07F1A8B8E3D04872A0D25545743DC2F9F807EE9AF6D085791E1172586F8174
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 1KB
SHA256 10347beefa4b94a9c22fd111a54c7e5dbf12401ccb545939286117131ed2a1ce
MD5 c82683807d3b7c35f59ac25c97232edd
SHA1 5372ca0b5d08e15637bc95516670ec3e27945af8
SHA512 39bcd3ce29dce2d15a0b95fbba7d7e627f85b37369c95f54932412e3238ae80ed3facd320084d7577ea102da620142206cc32e25a8e346abeb5b0ed577ba62c9
TLSH
T10F31A0B2C6E596ADDA4513F16A147E27CE5E0A08431C3C0AC9E8FF5BA7F2071D10158E
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 4dfb01309ebbbe3c903012e2a000b01e0f962e3ff45a30d5ca1f05cdd0f5c9a8
MD5 bdc4c4a1770a797542e5429c0b948934
SHA1 b7af488f752d2640ab81d708b7d65d7a7a93285a
SHA512 e7c99a82779e059498620660ff66cbf746fd525f6cfd1675264f32e557a4ad6093ddec84aeec09c30e2c4a7f5c33d75c03744e55a08aed7644d965ce2c2bdad6
SSDEEP 192:sxZ17RZyM/jK1Ml8MkbG/fXsxDXOV0IdpTnHW6+WNoQUZ/YvtFk6bIgrJ:sxZRzMK/fXsxDXITHbsZ/jK9
TLSH
T15952E8166A349977CCDBD20DF945BB53D6F50477E2900E88A9FCDA0C04E6AED221782F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 61c3190b22565a224947cbaf6b2ae224dce957ce01eae42c98a4f87d6d664378
MD5 0a2409f0ae1d1b9d0a961fddd2a134ce
SHA1 d6d66fda732264f869eefc4ac3868c73f9df470a
SHA512 247fbd9a24da841cf03915368ab5b2dda54808da60d2bc533d979011c26c9b40dc9fd4f40b61b49213e2629a9a7eb6afd6d6332b2c16212d6ff82e27dd93b06d
SSDEEP 192:sxZ17RZyM/jK1Ml8UQYkbG/fXsID2OV0IdpJnHW6+WNoqpZYvTHz896bIg5bJ:sxZRzq7K/fXsID2I5HbjZbKL
TLSH
T12252E716AA345977CCDBD21DF941BB53E6F54477A2900E84A9FCCB0C04E6AED221782F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 30KB
SHA256 f373fcc74a3af8e5a90086367222a0745fe502d203e7458ec349c05ab46748d1
MD5 93d79f4b1f936de886d37b54382179b1
SHA1 7db657ffeff7177c794621e71d2932ebc895d283
SHA512 da84c7870a73935fbc04d2794797cd49cb28a137a184411a35cc509520f0599d0635256f208986d96baa8e5e2f6c8ffc834924c0d51fcf09637e13ab6f8e26de
SSDEEP 768:5VseJ3xWvhfyn8F1+UoAYDCx9Tuqh0VfUC9xbog/OVYcLly0pp2rodK:5VseJ3xWvhfynu1jaVcL88pNE
TLSH
T1AAD20B2B280CCB7E4F844E6DEC266F966EE801CB57984D5487EA880C03C77EB51275DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 e64431e614b7fb6073d83e634a712eb660f47fc3e418f3b91d2764cdcec512bf
MD5 dfa252883ee0aee29d6328cf19c765d8
SHA1 c5ba3a319373d5c8a40c297bfb8aa84261bcae6c
SHA512 346f1f0c886ebcdf011c0d7a73316213cb5bb4d3b3e9581c3b8b4a72c2705d058dbb206ec6d9553b0ecd0faba9347704814ce5e3a8a8806ba14dfecc9872369b
SSDEEP 24:KdxwLfxwyxwRxwIaxwNdxwBxwhxwx4xwlxwB+xwsIjxwdxwxKixwOhaxwzxwx1EM:KYHIhKggkXyi0InKxmUTyNrIlKkswck
TLSH
T159A15D1E3439061138BD2988B6A1957A1F42319B3438646F7F7800920E6FD576FFD9ED
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

fd69979c-d6dd-475f-9024-2de2ddfd38c5.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\fd69979c-d6dd-475f-9024-2de2ddfd38c5.tmp
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 15KB
SHA256 8f1a9adfaac69b2f2d9b1511f610e68ef218bfe229438e856091b0a02c6d553f
MD5 5b11f438f3346d5bd2ac21de12002a7a
SHA1 0ed24c8266c2a866dabaed2758c46f5b6aa54ea6
SHA512 72afb081bd0224709f1223d1458b42a313049ff9ee245df3738d92cc7832fd546335db57068311bb4597ee4cb6b34bf48b634798de11b37d7b24d1b44060eac2
SSDEEP 192:uYm+xasuheOwQxMGsN2pPBaQjSrlM7/7CPMQmiU1SgXk4MTQv+FdLYxTkFd3Eth2:6ZcIhsN2+FG7/uErbQdExMdUJclpV
TLSH
T1D2626C729C785837A9F7F546F44A36134FF4816BE6C46F84A5ED6B1C01DA6A8030AC1B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 15KB
SHA256 fd36d1a96cc92151a250d4999db62e1eb22368748d6d1dd34df64e34a09ef1f3
MD5 2c70f506faa4d04d113b26854eada2c9
SHA1 66ddbc2d01b98833b6c2697514c48dad50531144
SHA512 8f0bcbf3e923d3ab8206a5699daebace817c828be3170f59ab8bee6861f88af271776bb63ade9137c7681f15eaf206c68a50b145a09dbb2a1ec911feb49f2c2b
SSDEEP 192:u6m+xasuheOwQxMGsN2UPBaQjSrlM7/7CPMQmiU1SgXk4MTQv+FdLYxTkFd3Eth2:AZcIhsN2rFG7/uErbQdExMdUJclpV
TLSH
T1DA626C729C745837A9F7F586F44A36135FF4806BE6C86F84A5ED6B0C01DA6A8030AC1B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 23KB
SHA256 c50b5d485db6d8f282978917e48dfeb08d92b2c4552afcb61d57d6d59ca75b3b
MD5 34043693d36372468b8b6795c4f8ca58
SHA1 a851fc91c6107d16e0bd534c58d807b0a0b5837c
SHA512 57e401ae75c3d6b8feb11ba7900b4d62372e284abe409c56d9b28001b2a35997694795de10564ca6e10234a25ce006541df356b06a54444eb0818319caa53818
SSDEEP 384:SiFiZcICzsN28TUNTUlIlrFG7/uEGbQdExMdUZclpV:ZFQKvwgHGLicLUZIpV
TLSH
T10BB2E7F248E7843AD9AEA747F77D2E134EBDC067B5845690B3985A0CCC961BFC306815
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 4e1f2c50340a1cdd38295b0224863c14681a66e04880f82ccf1a49eb6c6c3a22
MD5 3802cfda8eeb2f9fe51234e195f17ac3
SHA1 38178fdc275da2956152911222293769fa4cc3d4
SHA512 df57b79620abc941dc0a4c5a5e60a87a20ea193b78e4ab3cecf17e0e3c348e59d3b5429742db136c4ab2551a9603d64d0f38908f6e5dfcea6a853932fc4f6040
SSDEEP 192:lONw6vMtPQmiUyToThTQv+FdLYx5847o7U/u:lONw6UtRnT3dExByU/u
TLSH
T1A4020735AC786C7BAAB3AD46F08A37171FF4616FA6D05B54EAE82F1C00D765C1307826
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 9KB
SHA256 417014ff7da23185fe1925310380689cdc6e0bb914baf5da31bc0e01672eeec0
MD5 2fb3b4c9efb72e5f33c87987241c760a
SHA1 39a313ba0b0ec781a870746396885596c2303814
SHA512 cae52702520ecf69e3b1cbb21459da774e0363376c90d856b5ed51a813978f27a767740db7ba9666782dc92b49eda1db8435681b1c3fdedfc9c4b0b7cbc1ec61
SSDEEP 192:1ON36vMQPQmiUy27o5hTQv+FdLYxTkFd3Et380IcDquU/u:1ON36UQR253dExMdUeclU/u
TLSH
T1CB121B36A8745C27ADA3B586F08A36131EF1916BDAC46F90F6DD2F1C01DB66C1306816
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

d30c2b29-172d-41e8-875e-c228314905ad.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\d30c2b29-172d-41e8-875e-c228314905ad.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 df9e3d0eb569ec84ce1cfab633393d1805b2af29b15c8c25c13ec61a527d319a
MD5 b0b60b4884a51a79ad4429b3228b6cb6
SHA1 372947f62d1bbfbaaa0ae0c11bae15ff8d843d02
SHA512 4a3e6b5c42031cd039d76b1b799462b2190406096ea4ac33aed600b70a4d8ee4c6a90f0ffd794323caed8ca9e705b4968dd697fc2c4e7647f3f6172e01854585
TLSH
T160413B58B6E91145B3736F5AAFF6A86E487FB8772E06D46E10110E4F0B22B40C9B1737
MD5 SHA1 SHA512 TLSH

Submit Download