88bb088577096c251df7c42343ed3084d6751a793949590cbfd99a8a6ef95581

Analysis

max time kernel
148s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
27/07/2026, 12:30

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
v3/2017/08/25/index.html
Size 47KB
Sample260727-ppg11asxev
SHA256 88bb088577096c251df7c42343ed3084d6751a793949590cbfd99a8a6ef95581
MD5 ae2bd78b2c704a2e28893615f8c2dfa5
SHA1 d25decec78f04dc869f0d297d86eefd0dc5206b0
SHA512 561ebe7f8ddd213a60fb5bcfc9d92b24ad9aa7000d343197dbec970c7c745a3cf3becbbdc34b720e00fa239897d728c65b76ac2233e0f70cdb2b21dd203047a6
SSDEEP 768:W4QW+TiOmLKg8Vf7U7OmIHjGUULWcvy61maAv+bDD7Wy0PRe2lmC4/D:W1VfI7OJz1cvy61zAmbDD7Wy0PRe2lml
TLSH
T1CB231BF61899D43600E2F6847864EF05BBA35067CA159D92B3FD5B985F82EC3A5B330C
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4604	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134296290663732096"	msedge.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1788976790-1541110888-1636651838-1000\{04A3ABEA-E21A-4BB8-96FE-23E41BD217C9}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4356	msedge.exe
4356	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
1680	msedge.exe
1680	msedge.exe
1680	msedge.exe
1680	msedge.exe
1680	msedge.exe
1680	msedge.exe
1680	msedge.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
1680	msedge.exe
1680	msedge.exe
1680	msedge.exe
1680	msedge.exe
1680	msedge.exe
1680	msedge.exe
1680	msedge.exe
1680	msedge.exe
1680	msedge.exe
1680	msedge.exe
1680	msedge.exe
1680	msedge.exe
1680	msedge.exe
1680	msedge.exe
1680	msedge.exe
1680	msedge.exe
1680	msedge.exe
1680	msedge.exe
1680	msedge.exe
1680	msedge.exe
1680	msedge.exe
1680	msedge.exe
1680	msedge.exe
1680	msedge.exe
1680	msedge.exe
1680	msedge.exe
1680	msedge.exe
1680	msedge.exe
1680	msedge.exe
1680	msedge.exe
1680	msedge.exe
1680	msedge.exe
1680	msedge.exe
1680	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
1680	msedge.exe
1680	msedge.exe
1680	msedge.exe
1680	msedge.exe
1680	msedge.exe
1680	msedge.exe
1680	msedge.exe
1680	msedge.exe
1680	msedge.exe
1680	msedge.exe
1680	msedge.exe
1680	msedge.exe
1680	msedge.exe
1680	msedge.exe
1680	msedge.exe
1680	msedge.exe
1680	msedge.exe
1680	msedge.exe
1680	msedge.exe
1680	msedge.exe
1680	msedge.exe
1680	msedge.exe
1680	msedge.exe
1680	msedge.exe
1680	msedge.exe
1680	msedge.exe
1680	msedge.exe
1680	msedge.exe
1680	msedge.exe
1680	msedge.exe
1680	msedge.exe
1680	msedge.exe

Suspicious use of WriteProcessMemory 36 IoCs

description	pid	Process	procid_target
PID 1680 wrote to memory of 1816	1680	msedge.exe	84
PID 1680 wrote to memory of 4604	1680	msedge.exe	85
PID 1680 wrote to memory of 3792	1680	msedge.exe	86
PID 1680 wrote to memory of 3792	1680	msedge.exe	86
PID 1680 wrote to memory of 3792	1680	msedge.exe	86
PID 1680 wrote to memory of 5056	1680	msedge.exe	87
PID 1680 wrote to memory of 5056	1680	msedge.exe	87
PID 1680 wrote to memory of 2932	1680	msedge.exe	89
PID 1680 wrote to memory of 3256	1680	msedge.exe	90
PID 1680 wrote to memory of 2932	1680	msedge.exe	89
PID 1680 wrote to memory of 2932	1680	msedge.exe	89
PID 1680 wrote to memory of 3256	1680	msedge.exe	90
PID 1680 wrote to memory of 3256	1680	msedge.exe	90
PID 1680 wrote to memory of 3968	1680	msedge.exe	91
PID 1680 wrote to memory of 1116	1680	msedge.exe	92
PID 1680 wrote to memory of 3968	1680	msedge.exe	91
PID 1680 wrote to memory of 3968	1680	msedge.exe	91
PID 1680 wrote to memory of 1116	1680	msedge.exe	92
PID 1680 wrote to memory of 1116	1680	msedge.exe	92
PID 1680 wrote to memory of 1780	1680	msedge.exe	96
PID 1680 wrote to memory of 4192	1680	msedge.exe	97
PID 1680 wrote to memory of 1780	1680	msedge.exe	96
PID 1680 wrote to memory of 4192	1680	msedge.exe	97
PID 1680 wrote to memory of 1804	1680	msedge.exe	99
PID 1680 wrote to memory of 2232	1680	msedge.exe	103
PID 1680 wrote to memory of 2232	1680	msedge.exe	103
PID 1680 wrote to memory of 2232	1680	msedge.exe	103
PID 1680 wrote to memory of 4832	1680	msedge.exe	107
PID 1680 wrote to memory of 3176	1680	msedge.exe	108
PID 1680 wrote to memory of 2096	1680	msedge.exe	109
PID 1680 wrote to memory of 3248	1680	msedge.exe	117
PID 1680 wrote to memory of 3248	1680	msedge.exe	117
PID 1680 wrote to memory of 3248	1680	msedge.exe	117
PID 1680 wrote to memory of 4404	1680	msedge.exe	118
PID 1680 wrote to memory of 4404	1680	msedge.exe	118
PID 1680 wrote to memory of 4356	1680	msedge.exe	121

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument C:\Users\Admin\AppData\Local\Temp\v3\2017\08\25\index.html
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1680
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x2f0,0x7ff87066c188,0x7ff87066c194,0x7ff87066c1a0
  2⤵
  PID:1816
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1916,i,752608272918942894,10987349222400688565,524288 --field-trial-handle=2172,i,13131745076869140489,3857029009641627831,262144 --variations-seed-version --mojo-platform-channel-handle=2252 /prefetch:3
  2⤵
  - System Time Discovery
  PID:4604
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1632,i,15169248274322248307,16778038489851924642,262144 --field-trial-handle=2172,i,13131745076869140489,3857029009641627831,262144 --variations-seed-version --mojo-platform-channel-handle=2168 /prefetch:2
  2⤵
  PID:3792
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2368,i,6268659453615802088,10386402778521168513,524288 --field-trial-handle=2172,i,13131745076869140489,3857029009641627831,262144 --variations-seed-version --mojo-platform-channel-handle=2376 /prefetch:8
  2⤵
  PID:5056
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3456,i,7952492472865787308,2875729464804911087,2097152 --field-trial-handle=2172,i,13131745076869140489,3857029009641627831,262144 --variations-seed-version --mojo-platform-channel-handle=3452 /prefetch:1
  2⤵
  PID:2932
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3460,i,17659428796945925675,5900473744799547050,2097152 --field-trial-handle=2172,i,13131745076869140489,3857029009641627831,262144 --variations-seed-version --mojo-platform-channel-handle=3464 /prefetch:1
  2⤵
  PID:3256
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4124,i,13504286920678959123,10893089194661897255,2097152 --field-trial-handle=2172,i,13131745076869140489,3857029009641627831,262144 --variations-seed-version --mojo-platform-channel-handle=4280 /prefetch:1
  2⤵
  PID:3968
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4260,i,17598943334762324426,6290281918624783898,2097152 --field-trial-handle=2172,i,13131745076869140489,3857029009641627831,262144 --variations-seed-version --mojo-platform-channel-handle=4316 /prefetch:2
  2⤵
  PID:1116
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5108,i,14018548182659760544,13115769536290002755,524288 --field-trial-handle=2172,i,13131745076869140489,3857029009641627831,262144 --variations-seed-version --mojo-platform-channel-handle=5144 /prefetch:8
  2⤵
  PID:1780
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5112,i,14266994416464248013,14835587408511789334,524288 --field-trial-handle=2172,i,13131745076869140489,3857029009641627831,262144 --variations-seed-version --mojo-platform-channel-handle=5156 /prefetch:8
  2⤵
  PID:4192
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5912,i,5648410026229795360,183865587386949477,524288 --field-trial-handle=2172,i,13131745076869140489,3857029009641627831,262144 --variations-seed-version --mojo-platform-channel-handle=5936 /prefetch:8
  2⤵
  PID:1588
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5912,i,5648410026229795360,183865587386949477,524288 --field-trial-handle=2172,i,13131745076869140489,3857029009641627831,262144 --variations-seed-version --mojo-platform-channel-handle=5936 /prefetch:8
  2⤵
  PID:1804
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --always-read-main-dll --metrics-shmem-handle=4372,i,4643988990246298100,16454582928759550667,2097152 --field-trial-handle=2172,i,13131745076869140489,3857029009641627831,262144 --variations-seed-version --mojo-platform-channel-handle=3600 /prefetch:1
  2⤵
  PID:2232
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5952,i,9178708125819824068,3414899295963083505,524288 --field-trial-handle=2172,i,13131745076869140489,3857029009641627831,262144 --variations-seed-version --mojo-platform-channel-handle=6152 /prefetch:8
  2⤵
  PID:4832
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6228,i,6123803345227263256,14659861651815076663,524288 --field-trial-handle=2172,i,13131745076869140489,3857029009641627831,262144 --variations-seed-version --mojo-platform-channel-handle=6288 /prefetch:8
  2⤵
  PID:3176
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6300,i,8583260141708092770,10809101790345441612,524288 --field-trial-handle=2172,i,13131745076869140489,3857029009641627831,262144 --variations-seed-version --mojo-platform-channel-handle=3616 /prefetch:8
  2⤵
  PID:2096
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --always-read-main-dll --metrics-shmem-handle=5172,i,3728413263831061191,15723289054701013073,2097152 --field-trial-handle=2172,i,13131745076869140489,3857029009641627831,262144 --variations-seed-version --mojo-platform-channel-handle=4680 /prefetch:1
  2⤵
  PID:3248
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5328,i,9159040021659502618,6553602858920045318,524288 --field-trial-handle=2172,i,13131745076869140489,3857029009641627831,262144 --variations-seed-version --mojo-platform-channel-handle=5336 /prefetch:8
  2⤵
  PID:4404
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6412,i,4030424973827226487,9267719878856465510,262144 --field-trial-handle=2172,i,13131745076869140489,3857029009641627831,262144 --variations-seed-version --mojo-platform-channel-handle=6408 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4356

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:3752

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 92b83a0e542b7bb3ed324c35b5f2a40c47a6351981065b804e4d9d80ddd6d7ee
MD5 9ea20a12d0c030ae7f84014f382662b7
SHA1 7912569189cf07c1ce092a268e67e9f391b7c8c7
SHA512 39ca414f13163c8479fe7650ae0dd1607b267fe3f319c09aec7bd5f68448e9ac604351069bf6b166b3f897d3afb5d7f35e609b9fc72b9debbcb05bad8fad7d81
TLSH
T132D02B20FF04E002D1072172540047100E0848902093C140E030441CDCEC804D395307
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 7d64d2777f444a09968d6c155732e22d743fcf7c319c222bc06f6bb97808e489
MD5 89bc5edb6bd922f1cf8ec5536b066fa6
SHA1 c50aaf0fe1444780bb68ee7ab6e1c7468c2f303e
SHA512 77a1265c1484940562f1514202a0072e343efb323e1dcdb979fc9b7a2c69d85b814c076828b260c0b86a19e482ebb0a2df850f9b7c130a327861a7c56e26cde8
TLSH
T15CD02B20BF04E402D1072172540047100E0848902093C241E030441CCCED844D395307
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 dc9c76756896395a8b818f1730df1f7d49bc078297e5b17afd2ff06fca8ebe9d
MD5 81c8e5d19a1d65d3f2e266a974abac43
SHA1 eea6fddf9a770943f265bae0814b966305387dca
SHA512 5087dcbbf6b062465bd0cf8f785fd5a7bff0a77d1780e98e9c344b8e4ed4a5518da7fe3d7fb21ce9bfc79812376e0349faa9ae966246a716164a6ac8bba1b917
TLSH
T186615C73021238E4EB324273A7D22744747746D8FE6BDE6B7C90BBB81A4535DE01912E
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe585e96.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe585e96.TMP
Size 3KB
SHA256 d7c9790e5affe3aeb6f937b45f4a46efc67aa97bf057f66f0419793404583d2c
MD5 46add57abb6862e876630d7e4858fc70
SHA1 08e41693da9fe6a713cdba90865cfdc9df882f04
SHA512 f8d857da6308e9ff7e3c84d9ebdf2b44692ed8df615eaa57485c3b04c1b712c6c76342f58772e40228ad581dcf69890658f7e0e8ceb48abc25f074f142c918d7
TLSH
T157615C73021238E4EB324273A7D22744747746D8FE6BDD677C907BB81A4535DE01912E
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 3KB
SHA256 48ea31142b26dd682b142d625f7a023aca8ef28a5a7bd92718b26b229fb9205e
MD5 c33805e4faf58b56e3fbd6b3b35a2d55
SHA1 125a6811162ed69cc38e6826ad85d91324fc7715
SHA512 62ad2884ce7038119f46a436cd7e9a8a7291359d0435c6f9a192a7ae2c3d0511335d40ec0d381b4f5bafaac1ae09cfbe1fce99d3483bf218277ca9ae42db97b7
TLSH
T1C2619CB7C3D8876E881152F09B24AE2BCD1D495B422C3C568DE8EF1F63E24B1D20159F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 6d443a0d7086d226887c9365e6c5834269b1ca0d6b3e694e988ab2d53d3ad1d2
MD5 d5652bd65c6de64c4b87424b891f43c9
SHA1 64c361d5a115e058179652e6c3e06528d8f7594e
SHA512 aafb3f95faef80b5f8cc90bee25ad6172d4558be5c1f14f469aa8a00a9906d264e836e9b95b822e6f81657518004f9f33677e0345e21c26f08a7ede7a6fd2e3f
SSDEEP 192:sxZwRayM/jK1Ml8Mka/f/XsCU6mQVQIdpdxHW6+WNGYvrEjErzIgrJ:sxZwQMa/fvsCULeHHbGteL9
TLSH
T16E42D816AA345A77CCCBD20DFA51BF53D6F91562E2900E44A9FCCA0C04E7AED221781F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 90a0cb82236b95e060acb32712ac513f47e8477e66d306cb0c59cd66e047d44a
MD5 f282bfeac63936020c004d5c2d559023
SHA1 bb0a6f7f667cf9864b3e1a3502872c1287fef10d
SHA512 2a7f1a39cc76dcfa2b87b4d66837241471e9c5305cfc2dd36cd394c428485ebbd354242f3376210b7661b25808f199a204ddde31c0ae1a8bda77cd806944a6e3
SSDEEP 192:sxZJKRayM/jK1Ml8Mka/f/XszU7m+VQIdpdxHW6+WNGYvuEjErzIg5uJ:sxZJKQMa/fvszUq8HHbGUeLU
TLSH
T19552B716AA345A77CCDBD209FA41BF53DAF51562D2900E44AAFCCA0C05E7ADD231782F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 7d2990beffa2c598c0ca17ce0cee3c8c0fdafd8639d0882c041d63f04c4dafe5
MD5 6ab09812369b1b293c313f589a5a1a99
SHA1 a50402824bdabb07195b2a075c4fd750c385f23c
SHA512 a8059144fc475e4d7961689bbe3fe1b83515f1744edc42a59ac6ebc361565f7a4fd26b5e6bade722d76cac6a7df472ff5b5d6193bf15edad1acf334afd6187df
SSDEEP 192:sxZJKRayM/jK1Ml8Mka/f/XszU7m+VQIdpdxHW6+WNGYvuEjErzIg5uJ:sxZJKgMa/fvszUq8HHbGUeLU
TLSH
T1D752B716AA345A77CCDBD209FA41BF53DAF51562D2900E44AAFCCA0C05E7ADD221782F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 6607290911d5771c64851060290e6f36e8170acbca7114f5a771cc4ef70daeac
MD5 ad8c24afb99d7b006becbf9b317817b3
SHA1 cf8cb63bb4e139736c164db6fe4c033e4f2278a0
SHA512 28e2e86773f86bbe260fa5722008bb1ef9e0e610fbf5d19faf40f992d34f650a62bffceda4d56d9276c926e208eeeac12d2ef6b80cdf34abb94dd399e7bfc50e
SSDEEP 192:sxZJKRayM/jK1Ml8UQuka/f/XszU7m+VQIdpHxHW6+WNGYvGjjErzIg5uJ:sxZJKgqFa/fvszUq8RHbGpeLU
TLSH
T14F52A616AA345A77CCDBD219FA41BF53DAF55462D2900E44AAFC8A0C04E6ADD221781F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 30KB
SHA256 f77046ba01f7a1fb7490f7958259e5b4bc55499bc3028d5c4527f381fb208529
MD5 b9955a3f83be4ff169db5a10e173d563
SHA1 1b085764ae1a5f9718af45245ab90a1f986f1fb2
SHA512 33a9741f789c0142fd9d34f1a1cc5c08f7407393ccba72335cf791c95c3f64cc840162325a52ca4a1e19c35c9709ad275655ec5a6c03bdf577fee56362b623e9
SSDEEP 768:+4seJ3xWvhfyn8F1+UoAYDCx9Tuqh0VfUC9xbog/OVYcLly0ppvrovw:+4seJ3xWvhfynu1jaVcL88p84
TLSH
T1C3D20B2B680CCB7E4F844E6DEC266F966EE801CB57944D5487EA884C03C77EB51274DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 cf400a23522b8b567b8ca205e975679e102f1ed9d818f99fda85649f2ee47eef
MD5 7cd132ca7c26c219a82379e91642cdb8
SHA1 2e7755b1c31c3481fa1fe7362b94dc2261beb242
SHA512 19368309cf9f62dd2dec586b300d98722a20da8904fdead53b40b8f0ba20a37518b58b1364623d7d5b408a37d4152f1bf33531d6e9af718d5fee8ad68a45b7e6
SSDEEP 96:KYH+KggmArM/LRZJ2TZy9JL2KhTJV2ljrKFrnCAAKViC1:49zTHP1
TLSH
T1F1917513717E0242387F284CA295A5368F8235AB36E4B46F7BB804964F67E111DFCADD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 15KB
SHA256 32911677ba01eda37c8117d3fbb915a920dd48d52218296ff207c740ca043071
MD5 604d2ae33e2cfebebeba810810f97e1e
SHA1 f7f87c2a9d7cbb4c093b0d10ee8cbb1a320b0d4e
SHA512 105050555618f5ad1cea3a786f1039aefa7fc768f44d17099a47e21dff2413f53d68b38c1f6299374c78bd1bd6f1294e11ffab822daf5f3be80a1d200fd9c771
SSDEEP 192:uQm+xasuheOwQxMGsNAoQg3pM7aPcQmiU1/8QB4MTxQClqyN/8z1cqcuyKeYy:qZcIhsNAoZC7wsKQuIlvEnyK8
TLSH
T1C3626C729CB49D7B99ABF245F48A32034EF49067E7C45B50E5EC6F0D00EB668030B92B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 16KB
SHA256 869c8db7d1199363e16f6cb500e2bc4f9cfb91fc26877052fa3e3351329a342b
MD5 d967116988a3f44a7280f697ce77e634
SHA1 b2e6f5824add75c26d79742996f2e069b3a749f1
SHA512 c9826634f15505fbb09a2d0ab2094867721dfc3cb269884e58b203df38e4bce968fbb5724ab32644459c9b586dc7a37f5da62be89ac9aac536807cd34bfa085f
SSDEEP 192:uJ5Zm+xasuheOwQxMljzsNALQg3pM7aPcQmiU1/8QB4MTxQClqyNR8v1cqcuyKeN:4qZcImzsNALZC7wsKQuIlv6nyK8
TLSH
T1AA725C72DCB49D3B99ABA245F58A32034EF4A067E7C45B50E5EC6F0D00EB658130B92B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 462b770b4b0238e763bbcff45c40590da42fc40f7c02f45e425374f1fd0cecaa
MD5 cfefc05f32f29ed54d0ea5e3a45457ba
SHA1 6243c3af4f02ac62a6d107dfe78df2bb63fc9919
SHA512 cec0028f7dd556fe621adaa00c2d8e18acf3d160971c4b0bb4d81eab359ca605903329d36f1fb9bf602357302da02fd26a6e15d5ee2cb62894faa69f9e23ab4e
SSDEEP 96:eqONkPQsjpflMoUZre5ih/cIPURHl8h4otop59ODKBjPYvlCr5pgz6qNGemL5Xuq:lONP6vMtPQmiUyeaThTxQClT847tLU/u
TLSH
T10002F935AC786C7BDAA7AD45F48A23172FF4606FA5D05B50EAE82F1C00D765C1307827
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 9KB
SHA256 8c89ad9d88978c18dc17124193135c6cee39698f05418287bc4a333051bf005a
MD5 96aa14667d68c96286d0808e1342f981
SHA1 06fbc6fe45a7f279ae3bc13df5a0ee8af01a8d6c
SHA512 f2252ea082b3deb11c2714455894cef68f6fd0582ad5aa178b66c9dd5fa11fa652bba6ac5f40b04cec4a1446704d3ccc2195c1331609eba1ed38d9e5aa4fd6a6
SSDEEP 192:8ONp6vM1PQmiUyWarhTxQClqyNQ80IcqcuyU/u:8ONp6U1R8rblvVnyU/u
TLSH
T1A7120B76ECB89C6BAE97A541F08A32171EB0916BE6C49F50EADC2F1C01DF55C130B927
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 15KB
SHA256 b55bab8a04697d849bdbf88af573e5a155aa84f7c3144b310434193a1fc23964
MD5 e7a6541e5a24c6a267f0d2ef2567af55
SHA1 9a83b225e4cc76f42339be684f27549dafdda640
SHA512 5ab181596710902aab4fc31650c9924e88b20bf8e22204127bcf11f192b16e33fdac015822104a76229bcd3390872080542c46c4b108d6be46ae91b8596edff3
SSDEEP 192:uxm+xasuheOwQxMGsNALQg3pM7aPcQmiU1/8QB4MTxQClqyN/8z1cqcuyKeYy:/ZcIhsNALZC7wsKQuIlvEnyK8
TLSH
T190626C729C749D7B99ABF245F58A32035EF4A067E7C45B50E5EC6F0D00EB658030B92B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\metadata.json
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 5cd4b99fb32c85a979ebcb82b622969b8e0e6f57a5af824274a1249adf580941
MD5 b2723442867e8afe9aefc9ad27de579c
SHA1 3a3fb0f961fdb286d5a3b7731c628eaf7bfbb56c
SHA512 fe2428edb771c5b49822c123f9e4dc771cc928be2ce51495fdd07b34418ee02a8c2843a3ea03db2c410e0abccd91bd472212cb31cb4ae6e3b4fdd78b84a3aab4
TLSH
T16F41D859A6F91154B3B77E569BF6A86D487E7D772E0B855D00010E8F0B22B40CCB2737
MD5 SHA1 SHA512 TLSH

Submit Download