0fa51cf685692344aa9ff36a745eae2393052d9ca598a265f6dde41ed1068913

Analysis

max time kernel
148s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
27/07/2026, 12:30

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
v3/2017/08/20/emergency-services/index.html
Size 50KB
Sample260727-ppg11asxev
SHA256 0fa51cf685692344aa9ff36a745eae2393052d9ca598a265f6dde41ed1068913
MD5 5edf28f38e506f3ec338193a5d1298d5
SHA1 814b9be0b8d3c9f2a4402c43f26a78f1cc0a5517
SHA512 69efa1d3ce1052013ebfcd09d53eba84a750a57d98264a744afb30cadfe06d2bd74010e497630b3c8f9d758de0fcccb07283eb706ada44a65cfe32e96f570d94
SSDEEP 1536:W1K5I7O7n5Hvy61zAmbDD7Wy0PRe2lmd/D:qK7s+DD7Wy0PRe2lmdD
TLSH
T157332CF61896D03A00A3E29478A4EF05BBA35067CA15ED9273FD5B641F82DC3A5B331C
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
2488	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134296290949518616"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-540052884-2969440504-464782435-1000\{DBBFD06B-DD8F-42C2-9D71-B802C5F58EA2}	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3032	msedge.exe
3032	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
4400	msedge.exe
4400	msedge.exe
4400	msedge.exe
4400	msedge.exe
4400	msedge.exe
4400	msedge.exe
4400	msedge.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
4400	msedge.exe
4400	msedge.exe
4400	msedge.exe
4400	msedge.exe
4400	msedge.exe
4400	msedge.exe
4400	msedge.exe
4400	msedge.exe
4400	msedge.exe
4400	msedge.exe
4400	msedge.exe
4400	msedge.exe
4400	msedge.exe
4400	msedge.exe
4400	msedge.exe
4400	msedge.exe
4400	msedge.exe
4400	msedge.exe
4400	msedge.exe
4400	msedge.exe
4400	msedge.exe
4400	msedge.exe
4400	msedge.exe
4400	msedge.exe
4400	msedge.exe
4400	msedge.exe
4400	msedge.exe
4400	msedge.exe
4400	msedge.exe
4400	msedge.exe
4400	msedge.exe
4400	msedge.exe
4400	msedge.exe
4400	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
4400	msedge.exe
4400	msedge.exe
4400	msedge.exe
4400	msedge.exe
4400	msedge.exe
4400	msedge.exe
4400	msedge.exe
4400	msedge.exe
4400	msedge.exe
4400	msedge.exe
4400	msedge.exe
4400	msedge.exe
4400	msedge.exe
4400	msedge.exe
4400	msedge.exe
4400	msedge.exe
4400	msedge.exe
4400	msedge.exe
4400	msedge.exe
4400	msedge.exe
4400	msedge.exe
4400	msedge.exe
4400	msedge.exe
4400	msedge.exe
4400	msedge.exe
4400	msedge.exe
4400	msedge.exe
4400	msedge.exe
4400	msedge.exe
4400	msedge.exe
4400	msedge.exe
4400	msedge.exe

Suspicious use of WriteProcessMemory 36 IoCs

description	pid	Process	procid_target
PID 4400 wrote to memory of 1984	4400	msedge.exe	84
PID 4400 wrote to memory of 2488	4400	msedge.exe	85
PID 4400 wrote to memory of 1320	4400	msedge.exe	86
PID 4400 wrote to memory of 1320	4400	msedge.exe	86
PID 4400 wrote to memory of 1320	4400	msedge.exe	86
PID 4400 wrote to memory of 364	4400	msedge.exe	87
PID 4400 wrote to memory of 364	4400	msedge.exe	87
PID 4400 wrote to memory of 4540	4400	msedge.exe	90
PID 4400 wrote to memory of 2088	4400	msedge.exe	89
PID 4400 wrote to memory of 4540	4400	msedge.exe	90
PID 4400 wrote to memory of 4540	4400	msedge.exe	90
PID 4400 wrote to memory of 2088	4400	msedge.exe	89
PID 4400 wrote to memory of 2088	4400	msedge.exe	89
PID 4400 wrote to memory of 3236	4400	msedge.exe	91
PID 4400 wrote to memory of 3236	4400	msedge.exe	91
PID 4400 wrote to memory of 3236	4400	msedge.exe	91
PID 4400 wrote to memory of 4216	4400	msedge.exe	92
PID 4400 wrote to memory of 4216	4400	msedge.exe	92
PID 4400 wrote to memory of 4216	4400	msedge.exe	92
PID 4400 wrote to memory of 2424	4400	msedge.exe	97
PID 4400 wrote to memory of 2424	4400	msedge.exe	97
PID 4400 wrote to memory of 2720	4400	msedge.exe	98
PID 4400 wrote to memory of 2720	4400	msedge.exe	98
PID 4400 wrote to memory of 2100	4400	msedge.exe	102
PID 4400 wrote to memory of 4732	4400	msedge.exe	111
PID 4400 wrote to memory of 4732	4400	msedge.exe	111
PID 4400 wrote to memory of 4732	4400	msedge.exe	111
PID 4400 wrote to memory of 2780	4400	msedge.exe	113
PID 4400 wrote to memory of 4604	4400	msedge.exe	114
PID 4400 wrote to memory of 4284	4400	msedge.exe	115
PID 4400 wrote to memory of 3516	4400	msedge.exe	116
PID 4400 wrote to memory of 3516	4400	msedge.exe	116
PID 4400 wrote to memory of 3516	4400	msedge.exe	116
PID 4400 wrote to memory of 4192	4400	msedge.exe	117
PID 4400 wrote to memory of 4192	4400	msedge.exe	117
PID 4400 wrote to memory of 3032	4400	msedge.exe	122

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument C:\Users\Admin\AppData\Local\Temp\v3\2017\08\20\emergency-services\index.html
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4400
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x2f0,0x7ff92152c188,0x7ff92152c194,0x7ff92152c1a0
  2⤵
  PID:1984
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1988,i,18071245621031690256,3121552193583335799,524288 --field-trial-handle=2208,i,1814430296906886035,5272535879943381684,262144 --variations-seed-version --mojo-platform-channel-handle=2236 /prefetch:3
  2⤵
  - System Time Discovery
  PID:2488
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1632,i,8069685196479821453,1071720100199534459,262144 --field-trial-handle=2208,i,1814430296906886035,5272535879943381684,262144 --variations-seed-version --mojo-platform-channel-handle=2204 /prefetch:2
  2⤵
  PID:1320
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2556,i,346503190845937667,2710895997898468658,524288 --field-trial-handle=2208,i,1814430296906886035,5272535879943381684,262144 --variations-seed-version --mojo-platform-channel-handle=2720 /prefetch:8
  2⤵
  PID:364
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3448,i,2383091850542024028,589163489847002748,2097152 --field-trial-handle=2208,i,1814430296906886035,5272535879943381684,262144 --variations-seed-version --mojo-platform-channel-handle=3492 /prefetch:1
  2⤵
  PID:2088
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3468,i,8920152940124688279,5343097714195444406,2097152 --field-trial-handle=2208,i,1814430296906886035,5272535879943381684,262144 --variations-seed-version --mojo-platform-channel-handle=3556 /prefetch:1
  2⤵
  PID:4540
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4200,i,709611887246920912,14879757031550385325,2097152 --field-trial-handle=2208,i,1814430296906886035,5272535879943381684,262144 --variations-seed-version --mojo-platform-channel-handle=4252 /prefetch:1
  2⤵
  PID:3236
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4212,i,2018506043565628408,12865037136209202490,2097152 --field-trial-handle=2208,i,1814430296906886035,5272535879943381684,262144 --variations-seed-version --mojo-platform-channel-handle=4264 /prefetch:2
  2⤵
  PID:4216
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3712,i,13332740841101165479,9187378588494130119,524288 --field-trial-handle=2208,i,1814430296906886035,5272535879943381684,262144 --variations-seed-version --mojo-platform-channel-handle=3680 /prefetch:8
  2⤵
  PID:2424
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4936,i,476803455168863741,7950504056573551742,524288 --field-trial-handle=2208,i,1814430296906886035,5272535879943381684,262144 --variations-seed-version --mojo-platform-channel-handle=5272 /prefetch:8
  2⤵
  PID:2720
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5792,i,12986439851269933843,414029340772368397,524288 --field-trial-handle=2208,i,1814430296906886035,5272535879943381684,262144 --variations-seed-version --mojo-platform-channel-handle=5804 /prefetch:8
  2⤵
  PID:4876
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5792,i,12986439851269933843,414029340772368397,524288 --field-trial-handle=2208,i,1814430296906886035,5272535879943381684,262144 --variations-seed-version --mojo-platform-channel-handle=5804 /prefetch:8
  2⤵
  PID:2100
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --always-read-main-dll --metrics-shmem-handle=5764,i,767205342118015878,13109166522272876906,2097152 --field-trial-handle=2208,i,1814430296906886035,5272535879943381684,262144 --variations-seed-version --mojo-platform-channel-handle=3572 /prefetch:1
  2⤵
  PID:4732
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4216,i,11086704174744567898,4572581160604909444,524288 --field-trial-handle=2208,i,1814430296906886035,5272535879943381684,262144 --variations-seed-version --mojo-platform-channel-handle=4904 /prefetch:8
  2⤵
  PID:2780
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=560,i,14540238505255002666,8183940796373303629,524288 --field-trial-handle=2208,i,1814430296906886035,5272535879943381684,262144 --variations-seed-version --mojo-platform-channel-handle=4880 /prefetch:8
  2⤵
  PID:4604
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4372,i,3422300311271858276,2724304091561644137,524288 --field-trial-handle=2208,i,1814430296906886035,5272535879943381684,262144 --variations-seed-version --mojo-platform-channel-handle=6268 /prefetch:8
  2⤵
  PID:4284
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --always-read-main-dll --metrics-shmem-handle=4368,i,14872885001100979248,1170440580555814052,2097152 --field-trial-handle=2208,i,1814430296906886035,5272535879943381684,262144 --variations-seed-version --mojo-platform-channel-handle=5076 /prefetch:1
  2⤵
  PID:3516
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4360,i,1683872876327399741,1760112192638853063,524288 --field-trial-handle=2208,i,1814430296906886035,5272535879943381684,262144 --variations-seed-version --mojo-platform-channel-handle=4404 /prefetch:8
  2⤵
  PID:4192
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=748,i,13735047071221099110,5509374743477538153,262144 --field-trial-handle=2208,i,1814430296906886035,5272535879943381684,262144 --variations-seed-version --mojo-platform-channel-handle=6300 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3032

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:1712

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

blocklist

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\blocklist
Size 105KB
SHA256 deae8ba3a07225fe9f1490e4968fd83f8d308707a88a6d3d541d8ab416841ddf
MD5 1fcf11901014bf515178c91bdb7a6c5c
SHA1 4746b018067d9671617515224b7697b27fd2fc5f
SHA512 6059830103275d34e1aa4dd4e8d4177b6c2b684b2b3ad5417753387a227c838c0b258e662c78853cf649656ebd762f5d160c10349cd19ac1953380bd6572c660
SSDEEP 1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P7p:fwUQC5VwBIiElEd2K57P7p
TLSH
T16EB3B931457E36BF26E93EE828CF1511B84F3912664895D4ABE1FE2C4845E68633CEF4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 cc11c2ba3ec4cb292b61dd36af338e083bb0ce5868e654b17f3c58ecf3c8fdfb
MD5 22bfe5ff5070c92c37e54f6f278efd25
SHA1 2fc94025f3a738879f1fcececb95937cbaa0cdd1
SHA512 b57abd220e674cf733b39ea299fc66d6fe964ab448ae0758482efe80597e3678909cd989b9635acc0317001af0fe6dbbbccfd3cf110ec5ad1b9e4c084de22188
TLSH
T16FD09220B719A2C3E24704BA94A6AB52A916C57AA0B7F7017232640CAE65089F28F192
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 201729318e073e437978c4f830a6df095e397d14193bbab8cb94016e3e0e1540
MD5 038903102cb76ddedd18207430e00005
SHA1 e694b970e01eb43fddfb00d36857e2b64f8c931b
SHA512 bacb50167c8d736bccc259f2ffbffff915c7c6dc188c6c2c1476ded8cbd822ff968f690173d1b8e35c352ec62f9ace3913a556b80bc1a59211be000ee9ea7447
TLSH
T17DD092207759A6C3E24704BA94A5AB52A916C57AA0B7F7027232640CAE66089F28F192
MD5 SHA1 SHA512 TLSH

Submit Download

847bab05-9565-4d2b-a43d-015ab049f1f5.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\847bab05-9565-4d2b-a43d-015ab049f1f5.tmp
Size 30KB
SHA256 41a40a763fc70cc4a71dcdf353cceecb980deb5ae03f28e67e3e72082063e4d3
MD5 ae98c21ac9aa4b02951c63407edac8d1
SHA1 bb623d9fd6f7347288106579fb8a098b2368e052
SHA512 1641a4575a79836f577b0d7a6c0a8f2debb35eeab8b161464d2445a80e16c25a3211a8be4a4546fc230e059c639a093cf6596d18e7044711c848d8b12437b817
SSDEEP 768:5FsqxXlWvJD6T8F1+UoAYDCx9Tuqh0VfUC9xbog/OVk4Ll6AR9OroLM+:5FsqxXlWvJD6Tu1ja54LAs9FLz
TLSH
T19BD21B3B694CC77E4F840E5DEC2A6FD76ED801CBA6988D5447FA884C03CB2EA11165DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 fa9de404e90f3097239cf4149d1ff2773a5aadcb3465440634f4f99cdfa151b0
MD5 ee8e18b10d1cde94523ec8ccf1fda2c3
SHA1 8b0f102b46d898306ec529dc99048b73aee32b06
SHA512 809813f6c56a484c3afb00ab51424b05da8a60d00ed0987aa5af4496d46a4ed200dba866dd4f9563f8bb796aa3d883fd725b0b7d3597d28f1e8d9bae75c86955
TLSH
T15F71B630552697DFF7E602B191C12355F6728DEAFD273D411F2379B45E01FA0816A388
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 62d12a607391d2bb0056ffdc5e89d6bfc2d6ed3c20e11c12384bf1ca23cae53a
MD5 6a2a4caa053cff28d04b25b75b6718da
SHA1 6c3c068a1bf42b9583246a38e2e420e07caa4691
SHA512 1c95867b829a1c86b17e6d2d86cd437b45ef619cca0c8eb7300ca2d4ec3ba3ef4ae952b507c8795f410ca732ed101ae01fdc6d4a47c40473555b2169593dca7e
TLSH
T18C71B634551693DFF7E6027290C12255F6328DEAFE273D411F2375B55E01FA08169389
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe582e00.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe582e00.TMP
Size 3KB
SHA256 8a939f5c162c62bbe5d77af030acc74ef9c19094decb4fbd2b6a22403750a5c0
MD5 569aebb44766bd3f4eb88c8588a5997f
SHA1 0e551aff899d192a3b08125a2e6ac22802e7119d
SHA512 9a16d7341a23305db80bbfd145602831948557704ec71c3894c47e73d1d7abf38c1edae59a7aad80b0291f1aa3412cdd0dc9ed9a05f99e7806e7db162f7887ff
TLSH
T1B471B535551653DFF7E602B290C12359F6728DEAFE273E412F2379B45E01FA08169388
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 3KB
SHA256 36148059fdcb857c42cc040abbe1e6880c36a5c63360d9630078d2493b6e82f2
MD5 5b4a669717084b55e76aead40c14ba2e
SHA1 c37c73f3efb4caaf14396ad99a7e8913f1d4a8d2
SHA512 e3b25a1494c2a04e3b5e0f7a2337f5146ceefbffb28ec3052e7ff3e0d740ded67d175df13f8826a017402e5b2ca1c00f4ef46960d91e48ff81810100719bb32f
TLSH
T1B571ABB6C2D8876E881116F09B35AE2BCD1E055B42383C5689F8EF8B63E1571D20229F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 30699dbeacc00603cb4eefd77caec4a2946d343d7400f25f78ff20812796f8b0
MD5 16fa782c9a8fb5da1528365ce0d5cc76
SHA1 5704c92898e9e9081a3d78dab2078523350ff8b6
SHA512 e103184d7e880b14551dae1aa0737b27331bcc039142c118a11576259c7ab767d0d114cd6474ef5ef364442fb3ee9049e4f038b4f9c1695419cd2ff78b4d96ff
SSDEEP 192:sxZjHRe/yM/jK1Ml8MkQK/fw8soE6cV5QIdpdHHW6+WNGYIWOR5CIg5iSJ:sxZjH2MQK/fw8soE6cV5xFHbG/UAu
TLSH
T10152C616AA345977CCDBD309FA457B53D6F51572E2940E44AAFCCA0C04E6BED220782F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 8e289786562e4097e6c11bf5124728feabb9d588c3012cb362158a8b38c99f22
MD5 298cea6fc7f31124052a4f04b0df4431
SHA1 87590454c24408bbc824bcee2bfcd39c40d25246
SHA512 e01919b5765846310337d2c08ef3259456b8c7c5ceab7f01a4a8fa7fdb778a71569b69e234f7b8de972995447726c6efc639898990671c76fa2946fab3f315e7
SSDEEP 192:sxZjHRe/yM/jK1Ml8MkQK/fw8soE6cV5QIdpdHHW6+WNGYIWOR5CIg5iSJ:sxZjHOMQK/fw8soE6cV5xFHbG/UAu
TLSH
T1A052C516AA345977CCDBD309FA457B53D6F91572E2900E44AAFCCA0C04E6BED220782F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 10383f4c8ad03f74be90c0a454146a50a5dfd8631e8ffd8f8cc10cc52ef8045d
MD5 d45fccfe7b5421f295a305ce64e64bd2
SHA1 73a4ad7a335b1555150d49ab2bb2bccd33b835d6
SHA512 cbd9666dda71d08d06ba60445febd17169b471a37e2965d927943b7ee8df6a530cbc06886f641a94a0f58c5a90078ce8ee18032f3de353d2822d20a9962311d4
SSDEEP 192:sxZjHRe/yM/jK1Ml8UQoikQK/fw8soE6cV5QIdpHHHW6+WNGYIHxw5CIg5iSJ:sxZjH2qohQK/fw8soE6cV5xnHbGsUAu
TLSH
T13952C616AA345977CCDBD209FA457B53E6F51472E2941E44A9FCCA0C04E6BED220782F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 e6ce976a74f61a6aa46f9eb626ca4df3a5f424a491e00e70fa96e6f3e0b92137
MD5 17bdb753e125490cc76d1805fa08d4e2
SHA1 4cb37ab147e3e6d8969f45f59d8050b2da4a9983
SHA512 94676cc12c4a78980d25e0228f3ccf54ed77ae7569d511d3652a92b413390df8a9596009c03ab021fc2460106367b91263353599846c907e6f10f4ebfa15ddda
SSDEEP 192:sxZVHRe/yM/jK1Ml8MkQK/fw8soEwVAQIdpdHHW6+WNGYIkaR5CIgrJ:sxZVHOMQK/fw8soEwVAxFHbGTU9
TLSH
T1F842D616AB349977CCDBD309FA557B53D6F91472E2940E44A9FCCA0C04E6AEC221782F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 9ba530fa8b2b83b35b18740ce262d6213c387eea468fea9a63f2cd50a92922e7
MD5 073d3300c718a9d6a3516e6fb7ddcd1b
SHA1 a9d792d350641fb038aefb3beafe0444b5cda63d
SHA512 05ff8ff510a8227b1bfdedc570b75bc86f61bc84f533732dd48038ac9c7fb8c8ce38ec7c2dbb2b51802d4e90d4fb730cba25a0a0fa3bd419a1612320affe5da8
SSDEEP 48:KPYNs4iCiac6vpI9IaKGveOaS4K7H2oTy3JMdIdKegIvyNHIFKMkof:KYbaKYIKvdCKegCeHuKMk8
TLSH
T1C991101A757A0252387D38A8B26699374F413A63701CE46E3FB850A60B67E110DFDDED
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

025f2ae6-3bfe-4430-bf46-aa5ac731ee15.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\025f2ae6-3bfe-4430-bf46-aa5ac731ee15.tmp
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 19KB
SHA256 e1fdd1315f05ef5d6ba0dda76573b8a406208fc74dfb57a4ea66f85ea0cd4353
MD5 98c9560bb9bf2e4ec839e789b4ff08f2
SHA1 ba712a3a251e011c457da6785736d8c565c9985e
SHA512 edc69ab273ed0942bfb556cd399f7762f5f6d525122cdaa53e2de2eae9ce284b531f3a1668cd2b4b57beae90dd61fbc9f250008ba7bbc9d8f379019308b2fd61
SSDEEP 384:/nZcIhsNHa+PTbTUqjC5tXNVRNmd2OYo+aOd+wvDm4vsAv:nhbDHmRmJd+wyAv
TLSH
T1B8928F319C341C2B9EEBB645F54735135EF85127EBC92A4496DD9F0D01EE69C130BC1A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 20KB
SHA256 102b3cdafd39ab2ddfeacfcb1965bf97aafe7eb00ee2f1f85332d948ec1e0b82
MD5 4ec7da56c65016f87cd86a4e0f54b5e8
SHA1 2a40eb8fe1a8b99b03882f4ddd10d86a59fe3046
SHA512 0bf77bf101690712f95e3be7e014f04292e5c1bded493418cbaaba9ddda54f7ddff3605f997eb216da847a4286ed1a388ab28b732911af6605589f15143041b5
SSDEEP 384:UnZcIhsNHaPPTbTUqjC5tXNVRNmd2OYo+aOd+wvDm4vsAv:yhYDHmRmJd+wyAv
TLSH
T112928F319C341C2B9EEBB645F54735135EF89127EBC92A4496ED9F0D01EE69C130BC1A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 8a8776b68bdb41dd72c98c29505df8b04ceae4c97fa6eaaf84591f917088e0cf
MD5 5d5ce9dffd3ae9784faab4c7e22a78e4
SHA1 b1c6cd29eda72036b2fe38424c6d9eae77bcb596
SHA512 0a3c6c540d3a74554958402ebb5a1d22a4448968e3a54cdd0391bb3329971ee24fa737989e13ec06c8eab32d4e1346ae5332ad4b0bea4d45a5476eb2358e1735
SSDEEP 192:tON06JkRtQmiUyVLVEW+RN5+Fd107sh3aRRHJU6:tON06UrC5EW+RNmd28anJU6
TLSH
T16A02B835AC382CBB8EE66D0AF58B37135FA5217BBA952B84D6E81F0C01D765C1307827
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 22KB
SHA256 4cbccede9dbcc11ea1c1157d4c40e2d0d96d602a3284646abc3ea00a5adcbf05
MD5 b4711b94c4d4c009bdca9bbdab2df6d9
SHA1 0c6adee9b665d945fb61f0bb5a08aa58506d4395
SHA512 5f0526482132f9431f06efd5851219dbec97b935d12c7b757d60b26c436f0832dbad49b438ee0b7f16dd14194c033891b57275cb2f737515b8cb5544469ec903
SSDEEP 384:sMiFiZcI+zsNHi8TUNTUlIlPPTbTUqjC5tXNVRNmd2OYobaOd+wvDm4vsAv:YFQerwgUDHmRTJd+wyAv
TLSH
T15BA26C339C64983BAEFBAF45F64B31134EF85167DAC5AA50A7DC9E0D01EA19C130BC25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 21a02fcfc86c976579da71205056c847634735943528e579b36c5e8fdec43fbc
MD5 2c38458112f5dc0ffca1bfa3de619bd7
SHA1 b143cb9ae8f4b28e71b1499f7c6dcc00af0efbc6
SHA512 8317beab3114ad7749cd04195aed059a6f8613fed41bd5b903eee07e5b02a934d0612ad9e452f0230c90459810fbd682435d53f75a65d153b7bd729d50573845
SSDEEP 192:XmONzH6JkRMiQmiUyVwVEXP+RN5+Fd107ptpefPwoUXVcaDqlzU6:XmONzH6UMeCYEXP+RNmd2OYoHaOU6
TLSH
T162120A36A8686C7B4ED26945F48B35135EA45127EE8D3F80D5EC1F0C01EF6AC130B926
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\metadata.json
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 8e8f585a785606ec673bc06d41b5942ef9488ff77a250bba7c4737eceb5e9085
MD5 a0e435978472fa02c685580eaec4be30
SHA1 31d0c8c7fb8f064b5e73b0243a3dec037eb0acd3
SHA512 e43b4389579cdca47901fd0578bd043f1060e012c6ead8b5e30ab8518ab1ae561dbf49c8cff79b6d696c188dab8b924d6c8afa5e9bb68b272e601d1581b83420
TLSH
T19941289CBAF91148B3B26E56AFF6A86E547BB8772F06949D00010E4E0A63B40C871733
MD5 SHA1 SHA512 TLSH

Submit Download