578be6eaf21a4725c0e4b8713430c3b1fc9900ffea4f70d1fd03077cd42dee95

Analysis

max time kernel
148s
max time network
146s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
23/07/2026, 12:20

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
thank.html
Size 4KB
Sample260723-ph3dcsck3v
SHA256 578be6eaf21a4725c0e4b8713430c3b1fc9900ffea4f70d1fd03077cd42dee95
MD5 3c2355bb96a92366a8e4944d9c250e75
SHA1 c584a884a75567c4a62bceaa72252af0a8ad013c
SHA512 81bbeeda59b2f3eeb61b172c07ecfefe5d658d040f012f905a389fed86f1bae3667513bd7e4eee2365481b6c952d0a5099f181a778f822ea04cd4c64fb75f711
SSDEEP 48:yUt+OtDwPgUU309Dus74CRpkzvmDeJKuVtHHiG9c39W5G6E3gUqOUvgM:nQmDwPgQbR2vmDeJKuVtHHiZE5EgAM
TLSH
T138A1522518F450271052829ABAA37929EEC2D507D686CA54F8EC47DF0FF6EDBCD0362C
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
3744	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134292829396139289"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-668679576-120646659-2289335452-1000\{39615A46-5C62-49EC-9F0D-D2B91D015CA1}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3196	msedge.exe
3196	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
3924	msedge.exe
3924	msedge.exe
3924	msedge.exe
3924	msedge.exe
3924	msedge.exe
3924	msedge.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
3924	msedge.exe
3924	msedge.exe
3924	msedge.exe
3924	msedge.exe
3924	msedge.exe
3924	msedge.exe
3924	msedge.exe
3924	msedge.exe
3924	msedge.exe
3924	msedge.exe
3924	msedge.exe
3924	msedge.exe
3924	msedge.exe
3924	msedge.exe
3924	msedge.exe
3924	msedge.exe
3924	msedge.exe
3924	msedge.exe
3924	msedge.exe
3924	msedge.exe
3924	msedge.exe
3924	msedge.exe
3924	msedge.exe
3924	msedge.exe
3924	msedge.exe
3924	msedge.exe
3924	msedge.exe
3924	msedge.exe
3924	msedge.exe
3924	msedge.exe
3924	msedge.exe
3924	msedge.exe
3924	msedge.exe
3924	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
3924	msedge.exe
3924	msedge.exe
3924	msedge.exe
3924	msedge.exe
3924	msedge.exe
3924	msedge.exe
3924	msedge.exe
3924	msedge.exe
3924	msedge.exe
3924	msedge.exe
3924	msedge.exe
3924	msedge.exe
3924	msedge.exe
3924	msedge.exe
3924	msedge.exe
3924	msedge.exe
3924	msedge.exe
3924	msedge.exe
3924	msedge.exe
3924	msedge.exe
3924	msedge.exe
3924	msedge.exe
3924	msedge.exe
3924	msedge.exe
3924	msedge.exe
3924	msedge.exe
3924	msedge.exe
3924	msedge.exe
3924	msedge.exe
3924	msedge.exe
3924	msedge.exe
3924	msedge.exe

Suspicious use of WriteProcessMemory 33 IoCs

description	pid	Process	procid_target
PID 3924 wrote to memory of 2368	3924	msedge.exe	89
PID 3924 wrote to memory of 3744	3924	msedge.exe	90
PID 3924 wrote to memory of 4872	3924	msedge.exe	91
PID 3924 wrote to memory of 4872	3924	msedge.exe	91
PID 3924 wrote to memory of 4872	3924	msedge.exe	91
PID 3924 wrote to memory of 2340	3924	msedge.exe	92
PID 3924 wrote to memory of 2340	3924	msedge.exe	92
PID 3924 wrote to memory of 3360	3924	msedge.exe	93
PID 3924 wrote to memory of 3360	3924	msedge.exe	93
PID 3924 wrote to memory of 3360	3924	msedge.exe	93
PID 3924 wrote to memory of 3548	3924	msedge.exe	94
PID 3924 wrote to memory of 3548	3924	msedge.exe	94
PID 3924 wrote to memory of 3548	3924	msedge.exe	94
PID 3924 wrote to memory of 2428	3924	msedge.exe	95
PID 3924 wrote to memory of 240	3924	msedge.exe	96
PID 3924 wrote to memory of 2428	3924	msedge.exe	95
PID 3924 wrote to memory of 2428	3924	msedge.exe	95
PID 3924 wrote to memory of 240	3924	msedge.exe	96
PID 3924 wrote to memory of 240	3924	msedge.exe	96
PID 3924 wrote to memory of 1772	3924	msedge.exe	100
PID 3924 wrote to memory of 1812	3924	msedge.exe	101
PID 3924 wrote to memory of 1772	3924	msedge.exe	100
PID 3924 wrote to memory of 1812	3924	msedge.exe	101
PID 3924 wrote to memory of 4684	3924	msedge.exe	103
PID 3924 wrote to memory of 636	3924	msedge.exe	111
PID 3924 wrote to memory of 636	3924	msedge.exe	111
PID 3924 wrote to memory of 636	3924	msedge.exe	111
PID 3924 wrote to memory of 4012	3924	msedge.exe	113
PID 3924 wrote to memory of 1788	3924	msedge.exe	114
PID 3924 wrote to memory of 3336	3924	msedge.exe	115
PID 3924 wrote to memory of 4808	3924	msedge.exe	117
PID 3924 wrote to memory of 4808	3924	msedge.exe	117
PID 3924 wrote to memory of 3196	3924	msedge.exe	118

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument C:\Users\Admin\AppData\Local\Temp\thank.html
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3924
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x248,0x7ff9bc3ec188,0x7ff9bc3ec194,0x7ff9bc3ec1a0
  2⤵
  PID:2368
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1796,i,5658488364267051005,10684900963936915110,524288 --field-trial-handle=2272,i,17083596661462613716,1499560455033730412,262144 --variations-seed-version --mojo-platform-channel-handle=2356 /prefetch:3
  2⤵
  - System Time Discovery
  PID:3744
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1632,i,1184096392839840080,13182641090882020944,262144 --field-trial-handle=2272,i,17083596661462613716,1499560455033730412,262144 --variations-seed-version --mojo-platform-channel-handle=2268 /prefetch:2
  2⤵
  PID:4872
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2292,i,18335767052350237022,8741340663839614671,524288 --field-trial-handle=2272,i,17083596661462613716,1499560455033730412,262144 --variations-seed-version --mojo-platform-channel-handle=2392 /prefetch:8
  2⤵
  PID:2340
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3448,i,9470340023140631992,9434195093417901905,2097152 --field-trial-handle=2272,i,17083596661462613716,1499560455033730412,262144 --variations-seed-version --mojo-platform-channel-handle=3476 /prefetch:1
  2⤵
  PID:3360
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3468,i,5882811003798493673,1814433361086596388,2097152 --field-trial-handle=2272,i,17083596661462613716,1499560455033730412,262144 --variations-seed-version --mojo-platform-channel-handle=3504 /prefetch:1
  2⤵
  PID:3548
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4280,i,6927014176209969691,17987845267345705125,2097152 --field-trial-handle=2272,i,17083596661462613716,1499560455033730412,262144 --variations-seed-version --mojo-platform-channel-handle=4312 /prefetch:1
  2⤵
  PID:2428
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4292,i,11191407221018504855,8239779561953111135,2097152 --field-trial-handle=2272,i,17083596661462613716,1499560455033730412,262144 --variations-seed-version --mojo-platform-channel-handle=3428 /prefetch:2
  2⤵
  PID:240
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5144,i,789068554446799823,11279426228817001443,524288 --field-trial-handle=2272,i,17083596661462613716,1499560455033730412,262144 --variations-seed-version --mojo-platform-channel-handle=5220 /prefetch:8
  2⤵
  PID:1772
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5148,i,3316704025126972031,31656882980824363,524288 --field-trial-handle=2272,i,17083596661462613716,1499560455033730412,262144 --variations-seed-version --mojo-platform-channel-handle=5240 /prefetch:8
  2⤵
  PID:1812
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5936,i,12693454176597970348,15951205416262889283,524288 --field-trial-handle=2272,i,17083596661462613716,1499560455033730412,262144 --variations-seed-version --mojo-platform-channel-handle=5960 /prefetch:8
  2⤵
  PID:4736
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5936,i,12693454176597970348,15951205416262889283,524288 --field-trial-handle=2272,i,17083596661462613716,1499560455033730412,262144 --variations-seed-version --mojo-platform-channel-handle=5960 /prefetch:8
  2⤵
  PID:4684
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --always-read-main-dll --metrics-shmem-handle=6296,i,4065008142208006623,3309658245884798812,2097152 --field-trial-handle=2272,i,17083596661462613716,1499560455033730412,262144 --variations-seed-version --mojo-platform-channel-handle=6312 /prefetch:1
  2⤵
  PID:636
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6468,i,1382308357059634037,14351179642704381024,524288 --field-trial-handle=2272,i,17083596661462613716,1499560455033730412,262144 --variations-seed-version --mojo-platform-channel-handle=3492 /prefetch:8
  2⤵
  PID:4012
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6464,i,496617722243599777,14471508108820007578,524288 --field-trial-handle=2272,i,17083596661462613716,1499560455033730412,262144 --variations-seed-version --mojo-platform-channel-handle=6244 /prefetch:8
  2⤵
  PID:1788
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6388,i,4893664179034084685,3358460983769891201,524288 --field-trial-handle=2272,i,17083596661462613716,1499560455033730412,262144 --variations-seed-version --mojo-platform-channel-handle=6404 /prefetch:8
  2⤵
  PID:3336
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4400,i,8599455562637514295,5737815540721813140,524288 --field-trial-handle=2272,i,17083596661462613716,1499560455033730412,262144 --variations-seed-version --mojo-platform-channel-handle=4540 /prefetch:8
  2⤵
  PID:4808
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6168,i,11014614243272170532,17615664137282732679,262144 --field-trial-handle=2272,i,17083596661462613716,1499560455033730412,262144 --variations-seed-version --mojo-platform-channel-handle=6236 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3196

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:3516

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

blocklist

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\blocklist
Size 105KB
SHA256 deae8ba3a07225fe9f1490e4968fd83f8d308707a88a6d3d541d8ab416841ddf
MD5 1fcf11901014bf515178c91bdb7a6c5c
SHA1 4746b018067d9671617515224b7697b27fd2fc5f
SHA512 6059830103275d34e1aa4dd4e8d4177b6c2b684b2b3ad5417753387a227c838c0b258e662c78853cf649656ebd762f5d160c10349cd19ac1953380bd6572c660
SSDEEP 1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P7p:fwUQC5VwBIiElEd2K57P7p
TLSH
T16EB3B931457E36BF26E93EE828CF1511B84F3912664895D4ABE1FE2C4845E68633CEF4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CrashpadMetrics-active.pma

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\CrashpadMetrics-active.pma
Size 16KB
SHA256 814d47aad78c212b52568b9c7b58d242899d490d3afebce66181cae50c880df5
MD5 8c7cdfea4284ba987d295d82a9c7ddd6
SHA1 7d1a3a66f2d64a383b230196ba89a263ce7ee957
SHA512 59c8229e834c944265aed4131c79f41f9f940a48651b9fb18800cef5bae36d17c7fd5880120c6fee8ce22a157b65bc63846b65765bc4dc86e15926dcce400d0d
SSDEEP 12:sf9iXhV0xoUZxCe+JKlkQuMRxCb8TXuYJ0IJpPK6BsyW1inPiz:U9iRqxoUZxWMk8xVTeYWI31BtXP
TLSH
T105724C85B34498FFC8835E7189BD27903774F6DF1F02866B6A6A760E2E271C84F44224
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 1c8e6fcbb66aba64fe595f222fc4117e00e82ccdc0eef2100a1b4f7babb04f87
MD5 398d1e7948d46a763209c466fdacd0fb
SHA1 b26f2c32bc106089a59ce779d792beaba59f92bf
SHA512 a0bbf31d803e7333d004f03de9c261732d00cceb5d82dd64b5f0decf8adc8b840891187c72bb21cce83873e6d4dd2fab89d4c7efa320afe2ef3589678dcb1424
TLSH
T1B6D080277A196004F3964175A483D7061319956129575711F310C44CA9775D553C11C2
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 5d2c4e39ddbeb0ac61628bae04f1ac5787600ec893b0e230d1a84d61470771a9
MD5 cd6e704306442404371caebfec7f5b29
SHA1 e4beab8b7820af3633bf7c75a5498a958a95832e
SHA512 de66681a9245e8ece7d7e2ea2080251c395f2aeb8a885ac007eaf16f2ee3a3e36610d2afc17be964a038704371cedfbe4da91143ebed5adac20dbda97768d6e6
TLSH
T13AD080273A196404F7964175A483D7061319956129579712F310C44C99775D553C11C2
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 21cb2d7c3fd3bdc117a5b6c4b5a8304ae191ffa289f57633dabea35ac47abdc7
MD5 69b851ae5ae896d394f965796c56bbf2
SHA1 01453db9ae714ad9dc3a84f388ede57fc7bf6674
SHA512 50b9c96d16b6aed84b138c08ac0feefab5aff5682c7c5497a596501f89a10f12c55ea4ea1d07739ee5c79c71bcaa8f0d6cb3f75117b378192b6f164a15f3ef01
TLSH
T1D4717DFD2A92419FE394C2BA40F2C0047AF099E8F11FCEC9BDA05C302552BA1C268B94
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe592ce2.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe592ce2.TMP
Size 3KB
SHA256 2dfbe4c000cf59478c43e885482b88377156e508cd416014fe2d1f38c97c5a40
MD5 5e42127d316d7e2be329317724b98a27
SHA1 3dd395003a07cada668292ed6822fe7d598605c6
SHA512 8cbefd9726bd99470c0ab240abc24d39ca6b58dff9269a5b09545bfdda439db113b663e3129f7bcf17d3889fa1a20d75e7105ef463c75ee1ea554b5512ee5698
TLSH
T10C714CFD2A52419FF354C2BA40F2C10479F195E8F41FCECABDA05C302616BA5C269B98
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 3KB
SHA256 2b74e5da66c6a7f738e7333e305c77fa7a8a49c413b0a5aa6e94d5899b67b035
MD5 9ea2917e315266a16ad039fdcc460945
SHA1 0231e9ebfa894310e883021a7807445f16060302
SHA512 06e53f52fb0866cc8447773b01aa9520e1dd1d8c214c20af316a7a8fd65ceb79949527640f5697ca285950cd340218ddf281aa9fe11609fdf7a1bb57e80f382a
TLSH
T19C718BB7C3E5826DC81556F09A24BD1BCD1E195643283C2ACCE4AF5BA3E3471E20279F
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 638800591c0b942e31a941236059f848686b4f847f68126bbf7730255b4eabca
MD5 383055e28d36764508473115cb98419b
SHA1 753270216510366d6e9d5745ac3de8fa12f023fd
SHA512 dd70ac1f9f40d4a4ef68c3570893b5dc16d028fdb0e7c59d1cd56979314e449c9af7d2d210f780f48d6c068da7f6eeecaddb69cbb95f4f99d4a4e8c228e57cb6
SSDEEP 192:sxZxRdyM/jK1Ml8MkmW/fWsw6cl/IdpdkHW6+WNGYCk9/0cIgrJ:sxZxvMmW/fWsw6clwSHbGIR9
TLSH
T1FC42E9166A349977CCCBD209FA557F53D6F91472D2940E88A9FCCA1C04E6BED220782F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 0d2ad7eb421117294ef749378cf1ad7eed6304b3054e6293d3cef78f75b66cc2
MD5 055f997372fd32fd952efb6ba9b31741
SHA1 a9ec35f511bf43999084a69d64657a515e89028e
SHA512 13d8fae85be5378c9827c8dfea27ce63440215faafd92e8c6d325a9c364adfca9bf311b5d64d13279a6b7bd8c0dc453ac794ee15a25d16b941f85085a10ef2ab
SSDEEP 192:sxZxRdyM/jK1Ml8UQXkmW/fWsd6jlOIdpHcxHW6+WNwyYCEmA0cIg5wJ:sxZxvqUmW/fWsd6jlfwHbbmRO
TLSH
T17F52F916A6349977CCDBD209FA45BF53D6F55472D2900E84AAFCCA0C00E6BED620782F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 30KB
SHA256 86cff2bd1f0e213d849c834ecafd112786e4063b91d345849b1bb9fe67fd1a8e
MD5 d96658831047b06efa6124611346d670
SHA1 a0760822ea9e61f92e7694000d4fdc5e76b19d87
SHA512 04250700ca9622556058cfe428508e07d521e3c5012e74da65ec763e57971fed8bfdc25bf2130317517ff56cb6e0903e13d5a0809f9cce6e5915a4c3d3908f1e
SSDEEP 768:3E8bqn+WvSCt68F1+UoAYDCx9Tuqh0VfUC9xbog/OVnZLlRTKVsroh:3E8bqn+WvSCt6u1jaCZLbWV3h
TLSH
T18BD20A3B280CCB7E4F845E5CED26AF962DD801CB6B988D4447FA894C03C76EA511B5DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 fdf596ac1db40654eafc97eadf7fd8aa77b5c172b1e31886f007b1e1e3da9fed
MD5 84b23139d7e0c2371f175a238652f378
SHA1 32d0a1fe7bbf3eae0bdbd7b03e6ed2955db30e51
SHA512 1a176d36d1e439c858667f3b0e2f73fab77f0654cc9adb0670350d4d643562aad9a3b8b3cfbf0499a993a45010bb516bea5e464eb59217d418058058190746b3
SSDEEP 96:KA/ArPNhtY5p+L/HYKn9/lYTHnOlP1W9KKe8CaMAKdq8:ynBtXr
TLSH
T13891E222737B130338BE6919A659873B9D5132E33865A46E77FC40610A77E222EFC4DD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

0445416d-0af0-42f1-8f64-1ef465d9daa2.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\0445416d-0af0-42f1-8f64-1ef465d9daa2.tmp
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 15KB
SHA256 f1c09a9aed7435c92084100f76dd516a6b9bc2a09411c56f33d15fc0411cecf5
MD5 c21adb9375fe997a51ebecf5368509e8
SHA1 a176000bbce7dd60438208b54ed69b27931a60ef
SHA512 9f94edc0fad93e7d8a93294fae15b8564ed8fab758129098081f8a1cd12558d230d531b5423b5c33a96347413496ca6dba2e146374a52e7ac274ad2c4650af84
SSDEEP 384:ccsN4fhsjz0Ea+UOH+MHqzOObjI9G6w7mT+a:NgPaJOHZKz29MBa
TLSH
T138726C366C3C4C725DE3A555F48B36279FE450BBDA892B84E2DC9F0C05DFA9C530A826
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 3ec1d14d12a2ab73c4528046a8db108a79b697a9dae3bf9684d3ebb941cbc9ff
MD5 97702ebb2ffd67302c61157a2edd0384
SHA1 bb36846a0d20c1e5d7cdcf6e8aae49662dc57354
SHA512 048f4d6101db4bd302475b4d04e19ddef634bff3318b335ea650554315dbc1fb2c39b8d4fd2fe782f8bdee52cd0004b6327bec2e0a2e7c4335a4163a88b44701
SSDEEP 192:vONJ6Db6QmiUyCEHBa+joOmw+4sRgWCU6:vONJ6uAHBa+UOH+WxU6
TLSH
T19402D739687C5CBB9EE26E49F88B37275F94207BD9966B94D6D81F0C00D764C2307836
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 19KB
SHA256 bac7d211e1d1e7ce362093fffdd4f5928f53344a0cfa3982f4504c0fcbfa73fe
MD5 d9270f742097805eaad57b9de71f30e8
SHA1 cd3561bb20b6282f53496bb6284883f1e4cbe1a1
SHA512 f1059668327c591b6be127b890eab1a1ffa615cf47fb7c656f5c70e8bb7bad1ece1f7eb4b79f61e5d7db07922be97cd3802ce1ca003c7716170cb92ffec689b9
SSDEEP 384:clZcIhsN44hsjz0Ea+UOH+MHqzOObjI9G6w7mTP:ghbPaJOHZKz29Mo
TLSH
T17E929E366C3C5C7699E2A455F88B36275FF89077DBD92B84E1DCAF0C05DBA5C030A826
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 27KB
SHA256 bd3f073dfffd8ee239e088ada54e1d193d2e77ab399b660b625405c14bb62a3a
MD5 fd57d64171e52dc8bf3cebee5d93e5b6
SHA1 de20d28c331d11df9f0dec025353817fa5b32ab2
SHA512 6f211f1c690f472fcf7c7b6ef76f7e95bb781901aa229a48742da761a7738c7652af5dc86a48f1d72c5dc1d65370d39d52bf88cdc7627ed1af04951abec878ba
SSDEEP 384:CTiFiZcIezsNo8TUNTUlIldhsjK0Ea+UOH+MHjzOObjI9G6w7mTP:zFQ+twgJPaJOHZDz29Mo
TLSH
T108D218F258DB8836D9AE5747B77E2D174EBCC067F5855680B3889A0CCC965BFC30A821
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 20KB
SHA256 5083d1fc807d2619f68e54f35895da01c254ca6ba46d4bb4f5a9a2ce11a2985e
MD5 6d181f1a58c6cb4f1b8486b1a04ec185
SHA1 ebeadc09e67c6831ceb23f36addcb44623603f9c
SHA512 338c9b37a109356c756cd157f6cd4b1fd6286b04dc6721c4885d2d6289501836462211c036389fb2b65bc552f326d89245858926bf706c03865bdb0f279e9885
SSDEEP 384:KlZcIhsN4dhsjz0Ea+UOH+MHqzOObjI9G6w7mTP:ShuPaJOHZKz29Mo
TLSH
T1C3928D366C384C7299E2A455F88B36275FF89077DBC92B84E1DCAF0C05DBA5C130A826
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 24aacbee832485f7635e1cf0c7eea7446e1efcab6ecf9f16ee95431e528102fb
MD5 98a931dbbf2274ce2d1e498350e216b5
SHA1 fabadac03702c631dbecdb0892ef5464f28ca30a
SHA512 f62e7b97c6448efbcb8fe432258ef2d5901472f68e0fba4fe91250e96e85284b74b0d944ae38f5100cc115e3b5cd7a356810f8d8a960492896f33ed146ec28c1
SSDEEP 192:kuJONZ6DbexQmiUypEUBa+joOmw+4z5FfNznrqMU6:kEONZ6WPTUBa+UOH+MHZzU6
TLSH
T1BB122A366C3C5C775DE26584F88736275FA51067DA8A6B91D2DC2F0C01EFA5C130F826
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\metadata.json
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 8f97e18e51d5d645b305a7add375165635d293db3f0a631526bf3315bd101124
MD5 2d7a828d01e9f23def27a8ead5c55dfb
SHA1 763640393a3b6531e84959d4f4ef03257f344758
SHA512 49e019c3f336a528143c220c170fd0bbd3b7b6fbb01d72ea078947412cd76a69f77419cee65d167f0763aa170c18c76560ed9bfd28a68de282686d65fab4d16f
TLSH
T16341295CBAF91158B3B77F5A9BF7996D487BBC772E06D45D00110E0E0A23A41C8A2737
MD5 SHA1 SHA512 TLSH

Submit Download