hxxps://link[.]mail[.]beehiiv[.]com/v2/c/1df5d72b3acb9c704cba6284947a16e2b2595f4be5462721937397cf8ce3ce55fe2e5ec80cf9d4bb7d67f7b35326bbe38de1cbf06dfcf818e7f6c90d8e34370d4661ab667257749a8412716e5481a2fb9ab19f0e217d840584070331b7272ca01b2c66b4841d1b4c9fc002292ec53a4e71bf0802d1c9f11ddfc4f5a38f440ddb38f6c5961280b0fd196ec5cd84132fdc5136124404cc7752c9f2d48b9d155f2f/1fdfc41a23674165

Analysis

user interaction
yes
max time kernel
148s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
02/08/2026, 11:41

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://link.mail.beehiiv.com/v2/c/1df5d72b3acb9c704cba6284947a16e2b2595f4be5462721937397cf8ce3ce55fe2e5ec80cf9d4bb7d67f7b35326bbe38de1cbf06dfcf818e7f6c90d8e34370d4661ab667257749a8412716e5481a2fb9ab19f0e217d840584070331b7272ca01b2c66b4841d1b4c9fc002292ec53a4e71bf0802d1c9f11ddfc4f5a38f440ddb38f6c5961280b0fd196ec5cd84132fdc5136124404cc7752c9f2d48b9d155f2f/1fdfc41a23674165
Sample260802-ntwjhssbme

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
628	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134301445748711409"	msedge.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-3053180483-1881419501-3594244048-1000\{1EE33D09-DF58-4CB8-9B1E-54FBB343B10E}	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3032	msedge.exe
3032	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
4888	msedge.exe
4888	msedge.exe
4888	msedge.exe
4888	msedge.exe
4888	msedge.exe

Suspicious use of FindShellTrayWindow 35 IoCs

pid	Process
4888	msedge.exe
4888	msedge.exe
4888	msedge.exe
4888	msedge.exe
4888	msedge.exe
4888	msedge.exe
4888	msedge.exe
4888	msedge.exe
4888	msedge.exe
4888	msedge.exe
4888	msedge.exe
4888	msedge.exe
4888	msedge.exe
4888	msedge.exe
4888	msedge.exe
4888	msedge.exe
4888	msedge.exe
4888	msedge.exe
4888	msedge.exe
4888	msedge.exe
4888	msedge.exe
4888	msedge.exe
4888	msedge.exe
4888	msedge.exe
4888	msedge.exe
4888	msedge.exe
4888	msedge.exe
4888	msedge.exe
4888	msedge.exe
4888	msedge.exe
4888	msedge.exe
4888	msedge.exe
4888	msedge.exe
4888	msedge.exe
4888	msedge.exe

Suspicious use of SendNotifyMessage 34 IoCs

pid	Process
4888	msedge.exe
4888	msedge.exe
4888	msedge.exe
4888	msedge.exe
4888	msedge.exe
4888	msedge.exe
4888	msedge.exe
4888	msedge.exe
4888	msedge.exe
4888	msedge.exe
4888	msedge.exe
4888	msedge.exe
4888	msedge.exe
4888	msedge.exe
4888	msedge.exe
4888	msedge.exe
4888	msedge.exe
4888	msedge.exe
4888	msedge.exe
4888	msedge.exe
4888	msedge.exe
4888	msedge.exe
4888	msedge.exe
4888	msedge.exe
4888	msedge.exe
4888	msedge.exe
4888	msedge.exe
4888	msedge.exe
4888	msedge.exe
4888	msedge.exe
4888	msedge.exe
4888	msedge.exe
4888	msedge.exe
4888	msedge.exe

Suspicious use of WriteProcessMemory 32 IoCs

description	pid	Process	procid_target
PID 4888 wrote to memory of 4700	4888	msedge.exe	86
PID 4888 wrote to memory of 2076	4888	msedge.exe	87
PID 4888 wrote to memory of 628	4888	msedge.exe	88
PID 4888 wrote to memory of 2076	4888	msedge.exe	87
PID 4888 wrote to memory of 2076	4888	msedge.exe	87
PID 4888 wrote to memory of 3888	4888	msedge.exe	89
PID 4888 wrote to memory of 3888	4888	msedge.exe	89
PID 4888 wrote to memory of 944	4888	msedge.exe	90
PID 4888 wrote to memory of 6016	4888	msedge.exe	91
PID 4888 wrote to memory of 944	4888	msedge.exe	90
PID 4888 wrote to memory of 944	4888	msedge.exe	90
PID 4888 wrote to memory of 6016	4888	msedge.exe	91
PID 4888 wrote to memory of 6016	4888	msedge.exe	91
PID 4888 wrote to memory of 3360	4888	msedge.exe	95
PID 4888 wrote to memory of 3360	4888	msedge.exe	95
PID 4888 wrote to memory of 3360	4888	msedge.exe	95
PID 4888 wrote to memory of 5876	4888	msedge.exe	96
PID 4888 wrote to memory of 5876	4888	msedge.exe	96
PID 4888 wrote to memory of 5876	4888	msedge.exe	96
PID 4888 wrote to memory of 388	4888	msedge.exe	97
PID 4888 wrote to memory of 388	4888	msedge.exe	97
PID 4888 wrote to memory of 5136	4888	msedge.exe	98
PID 4888 wrote to memory of 5136	4888	msedge.exe	98
PID 4888 wrote to memory of 2152	4888	msedge.exe	100
PID 4888 wrote to memory of 2420	4888	msedge.exe	108
PID 4888 wrote to memory of 3844	4888	msedge.exe	109
PID 4888 wrote to memory of 5168	4888	msedge.exe	110
PID 4888 wrote to memory of 3320	4888	msedge.exe	112
PID 4888 wrote to memory of 3320	4888	msedge.exe	112
PID 4888 wrote to memory of 1700	4888	msedge.exe	122
PID 4888 wrote to memory of 1700	4888	msedge.exe	122
PID 4888 wrote to memory of 3032	4888	msedge.exe	124

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://link.mail.beehiiv.com/v2/c/1df5d72b3acb9c704cba6284947a16e2b2595f4be5462721937397cf8ce3ce55fe2e5ec80cf9d4bb7d67f7b35326bbe38de1cbf06dfcf818e7f6c90d8e34370d4661ab667257749a8412716e5481a2fb9ab19f0e217d840584070331b7272ca01b2c66b4841d1b4c9fc002292ec53a4e71bf0802d1c9f11ddfc4f5a38f440ddb38f6c5961280b0fd196ec5cd84132fdc5136124404cc7752c9f2d48b9d155f2f/1fdfc41a23674165
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4888
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x2f0,0x7ffaa0d2c188,0x7ffaa0d2c194,0x7ffaa0d2c1a0
  2⤵
  PID:4700
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1904,i,5541965606053479531,13621773912916866671,262144 --field-trial-handle=2284,i,3975527432232978228,2792350254253061081,262144 --variations-seed-version --mojo-platform-channel-handle=2280 /prefetch:2
  2⤵
  PID:2076
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2008,i,7847280553695751259,8196019466629536496,524288 --field-trial-handle=2284,i,3975527432232978228,2792350254253061081,262144 --variations-seed-version --mojo-platform-channel-handle=2352 /prefetch:3
  2⤵
  - System Time Discovery
  PID:628
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2468,i,14381102063999537724,11564831989155906300,524288 --field-trial-handle=2284,i,3975527432232978228,2792350254253061081,262144 --variations-seed-version --mojo-platform-channel-handle=3016 /prefetch:8
  2⤵
  PID:3888
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3504,i,1140880008131153471,4589974622212983420,2097152 --field-trial-handle=2284,i,3975527432232978228,2792350254253061081,262144 --variations-seed-version --mojo-platform-channel-handle=3524 /prefetch:1
  2⤵
  PID:944
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3484,i,7200430401945525161,4627178569175778393,2097152 --field-trial-handle=2284,i,3975527432232978228,2792350254253061081,262144 --variations-seed-version --mojo-platform-channel-handle=3516 /prefetch:1
  2⤵
  PID:6016
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=5324,i,16970559814345892404,15265056591664218469,2097152 --field-trial-handle=2284,i,3975527432232978228,2792350254253061081,262144 --variations-seed-version --mojo-platform-channel-handle=5580 /prefetch:1
  2⤵
  PID:3360
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=5332,i,6945447557338725984,478039962202977058,2097152 --field-trial-handle=2284,i,3975527432232978228,2792350254253061081,262144 --variations-seed-version --mojo-platform-channel-handle=5728 /prefetch:1
  2⤵
  PID:5876
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5176,i,3300412757603732588,8190337724136907914,524288 --field-trial-handle=2284,i,3975527432232978228,2792350254253061081,262144 --variations-seed-version --mojo-platform-channel-handle=5916 /prefetch:8
  2⤵
  PID:388
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5172,i,1984005514078280597,7077083881349689404,524288 --field-trial-handle=2284,i,3975527432232978228,2792350254253061081,262144 --variations-seed-version --mojo-platform-channel-handle=5564 /prefetch:8
  2⤵
  PID:5136
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6404,i,8717779536872529270,12791461271900445736,524288 --field-trial-handle=2284,i,3975527432232978228,2792350254253061081,262144 --variations-seed-version --mojo-platform-channel-handle=6444 /prefetch:8
  2⤵
  PID:3080
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6404,i,8717779536872529270,12791461271900445736,524288 --field-trial-handle=2284,i,3975527432232978228,2792350254253061081,262144 --variations-seed-version --mojo-platform-channel-handle=6444 /prefetch:8
  2⤵
  PID:2152
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6684,i,14090166059708652573,10893896901182371544,524288 --field-trial-handle=2284,i,3975527432232978228,2792350254253061081,262144 --variations-seed-version --mojo-platform-channel-handle=6656 /prefetch:8
  2⤵
  PID:2420
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6688,i,14521403294408655965,13851837441269538016,524288 --field-trial-handle=2284,i,3975527432232978228,2792350254253061081,262144 --variations-seed-version --mojo-platform-channel-handle=6660 /prefetch:8
  2⤵
  PID:3844
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6692,i,15629921299329486082,7450774219552248328,524288 --field-trial-handle=2284,i,3975527432232978228,2792350254253061081,262144 --variations-seed-version --mojo-platform-channel-handle=6624 /prefetch:8
  2⤵
  PID:5168
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --lang=en-US --service-sandbox-type=collections --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6736,i,2381399345666664314,13550301201562974657,524288 --field-trial-handle=2284,i,3975527432232978228,2792350254253061081,262144 --variations-seed-version --mojo-platform-channel-handle=6756 /prefetch:8
  2⤵
  PID:3320
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6228,i,14624160056995424157,7745679583391497098,524288 --field-trial-handle=2284,i,3975527432232978228,2792350254253061081,262144 --variations-seed-version --mojo-platform-channel-handle=2176 /prefetch:8
  2⤵
  PID:1700
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=5232,i,6946750361859821341,4840999754613374902,262144 --field-trial-handle=2284,i,3975527432232978228,2792350254253061081,262144 --variations-seed-version --mojo-platform-channel-handle=7036 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3032

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:4396

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:5960

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 9300dc4b11c647d4484e20f994dffbbd9939379d590fc7dedf9875372c431ce1
MD5 b031933009b03b3dcfc6f363760f83dd
SHA1 a9d3126d19c73dafd7e12a688bb3a802627790ee
SHA512 f606a12a9a0879bb3f7d6c9bcb6e3754434b9f0d8f1d351e8104aef087c326f689af5174eddcb6a3cd1f1d07864ff544fc76e73f8b76bf6d4330e19666cb7b28
TLSH
T18FD012BA2A4E7010F26D4A31B416CB00776D15A12852A705E22D944C99A90A562C62C6
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 8da58a9b03c676d64167caf3657c5315a0b78038e3ae23bfef432a40d8d22290
MD5 81f1d957977f2d73471366011b7128bf
SHA1 c3403bfa34ee45b494966cf8be9bed08da2c5168
SHA512 171afd7f20b750bc0bdc1fc9fd4cf14984e63031e562c60a7b1bab3112c84572ebc63669b744e0e5399b2f5453039fb86937cf7ab417a72da7f1ad931c88f0c5
TLSH
T152D012B62A4A7010F2694A31B456CB00776D15A12852A705E26D945C99A90A566C62C6
MD5 SHA1 SHA512 TLSH

Submit Download

0f6b7ffd-26c4-40e1-9c97-7f9e0cb37adb.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\0f6b7ffd-26c4-40e1-9c97-7f9e0cb37adb.tmp
Size 15KB
SHA256 d45ae0d54d19430cc459356cb1d54280f2c5a9409bc6ff508bec50a9e013b1fc
MD5 ee3d7037068da0c3b731aa2404b5b9d2
SHA1 ed7c7db786848e23d039a016342cd8f2c59851af
SHA512 6a7d97e48eb701628e2b6d2eb0ec29bd449904e1b200f3e13da73faff0f7e5d09bd4add170a8a9dcee4035912c4e2d5a797d81a22cc720fe6f6697e3a877e2bc
SSDEEP 192:sxZVR0yMqZjK1Ml8Mkx/f3ssd6aZdGzodpiLHW6+WNwwp/Yv0utsheIgjOJ:sxZVFMx/f3ssd6az9sHbF/Xgja
TLSH
T15262F8166A3899778DDBD619FA45BB53D3F9113392904E44A9FCCA0C04E7BED221382F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BrowsingTopicsState
Size 414B
SHA256 8e0be6dec7428bedb4730d681ef4dc8730abb57196e710a603aeb3a5c29c90cc
MD5 35c90f56ecf54faeeb3a760a108df7df
SHA1 acfdd43eacd64beb329080abc50eb352992e44cd
SHA512 045edca11c6b5b96c4888d0396696aa79a505753599c1be1d360fedb03b27f7f983c2a1f586ded6aa91cd90d2573d279faece5cb02ff30374d0a34c676f5a273
TLSH
T1C5E02B75C821EC370DFD0B18600D4756E75013673641496F3B3C910C8FF863A45D685C
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 5KB
SHA256 3dbaa73e186c3c1042e9ac0c94efdba4161bf7b64d1effa07b1ae532546d1a67
MD5 8d488f16a864517673a7517d51415c1a
SHA1 c2d1eb959864bf6480b1b9d965ddab0c414bc75a
SHA512 a58896b7c590aac9cfffd598eecb2f31d757a9135868dbaffc13ce8fa4b682305819ab878d54d76a88d9e955afc5bf54685f369cfcde837c134776bbc10bc7d5
SSDEEP 96:RLBYGEEx2lHf1916B1dPKp4M2U1IsQKqY:wGGjaDdPKKMBsY
TLSH
T16AB1E632D94228F2EBEE403170C00BC53E75E7EAFA13EEA452907478C88BB51409F5B4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 5KB
SHA256 888ba8100ee12f69c7c0ea2085c76cf19af6a0a0d4cf9424a6c1e5fe4e72021e
MD5 8bfc317ffcd5c252886a7d96b04f69b8
SHA1 5678cedcba316863e8e80dc8aa2d24b717b6318b
SHA512 a0149244d56c380f36d71bfb9d2d88074bf6f307a89acd4efb0fc252cc4401146dcfab66cc848430595e6592e9626377b4bf321d535e9518fda5b5fe65b64dfa
SSDEEP 96:D1u/MOunu9ueuraaij6UMugbzBuOuLu/BubuT4u3utu+u14uNu2Gu7unwjVuOuM:D16Hwgj+aaij6px1T0sM+4kkbu4ifGWf
TLSH
T11BB17DF783E4862ED91253F4AA146E2FCF2D1825471C3C39C9E5AE17A3E24A1E141B5E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 15KB
SHA256 3f6c246329eb40cc98f24cc6ec43d153f58ea99e0682fe19a802543ce3447d03
MD5 d5a5f87a2437a41166a64d2084a7d385
SHA1 8808040248f7309b0b0d58b34bbf914a82473a95
SHA512 7042a435832eb5f4739384813cf675971e5450d60bbf3d7a52876f20820d69bd9c89b286edebe200070798c5d9740b3212761d747a6241c5da22fd0b9e4a9a2a
SSDEEP 192:sxZVR0yMqZjK1Ml8UQb9x/f3sFhZdGzodpiLHW6+WNwF7dYv2trheIg5n7OJ:sxZVFqpx/f3sFhz9sHbmd1g57a
TLSH
T1EB72F8166A3899778DDBD619FA457B53D3F91033A2914E54A9FCDA1C00E7BEC220381F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 30KB
SHA256 69690d2198cc306427fbb8202494acb3e58ca790c539ab8396a31bbe3545a3a8
MD5 9166f7b9794665be027a1291532d1ec5
SHA1 48981e4fe99bb26e05e00212afb0383a9fc696cd
SHA512 1519e1ca6e5e68d98f9a18776fedd7dababef57a24ac9285707effaf4f10fe9913e2555e74f75ec093c5981b2a824ccf2c42231e4e98c2f38b6983b65a1cb30a
SSDEEP 768:ZYsv8Od/hWvFvQX8F1+UoAYDCx9Tuqh0VfUC9xbog/OVA0LlEe9NsQro9RLG:eY8Od/hWvFvQXu1ja10Lm2Nu/S
TLSH
T1F8E20C3B284CCB7E4F840E9DEC26AFD66DD801CB66984D5447FA884C02C77EB521B59B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 96B
SHA256 6956b301c78d319e4b9373477afb2d218b182456b73d315bae9b780df1b1c6d5
MD5 c14d6158033074446e6ab1c8be196db8
SHA1 70b78b3d7b76e1ef48e5a70c4a65b23dd2d940e0
SHA512 f427e31290594f5ef3b02d96514cfcaea123f21e4c8a9943e87d39f7b5462e8607d7ade64c5730a8370fd178a7ac0c659221e7352edcb1372b1ec459f43a3bdc
TLSH
T128B02200000CE8EBC08023B0B0882200B2300EA0030E032323A8E8F8ABC2B0002CA002
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe58b244.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe58b244.TMP
Size 48B
SHA256 23a9fa6513a5dc445400399cc49b6bc359c641b8e517ae4c9d62f3b4203858bd
MD5 ea2aa23a3da283bc7e781f6de28f24cd
SHA1 8f6f8672cd8b082c08153dbac98334e7ba960979
SHA512 5c8873feb1bb6c40cc7a4a530c4c0c02ddfabc705e652c210064ff8970f58151e7f773dea7bf1d2bc2c0654a277ffdafd5f53e58d9fd442cf51d0d56d46817a5
MD5 SHA1 SHA512

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 23KB
SHA256 8d157bc50de25a055ed252b8a6dc4b105f80611f557a014aca5708417ddf5bc5
MD5 a3c88a67cf2d16c492d38661878ce491
SHA1 21e560e5a456d10c7378c51efcff1a7da79fcf60
SHA512 3e1cec8ab9f585f2922f965d93c79afc7bc1273df5b153094a9c3ec78a5975bbbfcfef58ba0fbff86f33f8e4955d0ffe265a920719d2f1ffdc1f617330197b2a
SSDEEP 96:Ko7iKcsW23iKoM7LKKc026WEKjKkAAK9Gq+xGKqkJ7yKkc++dmKWI94gK966GbGZ:05ppxnY753RNBvRJJdt7p5J9NpZj
TLSH
T1EBB2695A703A0211393E2988B39696364F4235A37058E4BF7FB814A54F67E225CFDCED
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

ec6d7f3f-bf15-4f33-9a36-f6e1d874d106.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\ec6d7f3f-bf15-4f33-9a36-f6e1d874d106.tmp
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 33KB
SHA256 0d4e9681a5d22003a1ac9b9c4990678bed6d52f3223c46e8f872050706c5b34c
MD5 6596aa1f0acd400c67e27fb4f7d4ea92
SHA1 37f50999122ed07882d5aea59a90c0536aac651f
SHA512 e2792e901782965d0d977224cd65919983ea570137cf3a00a6d5dfd8cb1b33022cf27d78cb6af5307ce2a2cc61688d4df9fb313b30c5fa8f9768b3296df61291
SSDEEP 384:ntiFiZcIzj3sNL8TUNTUlI4hQckCrIX1KphiftGNZO0saBkyr6B2SnTKwBODNZO5:kFQn3uwgAk1koGNEls6B2SnewBKZOfx
TLSH
T171F2C2F198D78973E9AE4B87A77D2D029AFCC113B5885A94B7D85D1CCC821BFC30A815
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 28KB
SHA256 75b83ae0da60b56de57d15b038227ce4ee3707e495bbb685e64a6a1eda25b153
MD5 c6a7e45d37cf8edc4775ede157410315
SHA1 6aae133a084477baff3452a0ee5228f9af3f1fe2
SHA512 2986a9705dcbe82206d91e5d5383199b6609e88504b9c009d312c6a8cfefc3c1159ba7fd4e4925438c1b7bafc2683a5c5267dedea265f13970ecfc14dac51c4d
SSDEEP 384:nDiFiZcIV3sNL8TUNTUlI4hQckCrIS1KphiftGNZO0saBkyr8B2SnTKwBODNZOC8:uFQV3uwgAkgkoGNEls8B2SnewBKZOfx
TLSH
T194D25A32D868CAB7EDE75F89A74A36079EF44263D58C5AE8D5DD6E1C009719C030BC26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 25KB
SHA256 dd8a03a1da3c5c86215064892cd8b636b837b5e21e1a4612abbb768bfa7a1a18
MD5 86a8d53483cafbabc659c8a0ffee2945
SHA1 879048f60b7a611c6ff2a505789e03f6129841fe
SHA512 fc2b5f3358b6c3e0d61c8ac5ea7517f3267a32c4367ed4c28681e06b4aaa8c806a0ad83a597bcf9db92236a14ec75f784d809e53c3160603900eebbb262e4265
SSDEEP 384:npBiF9CcmyWCs3sNH8TUNTUlIm2QckCr9qOLphiftGNZO0saBkyrwB2Se4KV8p0e:poFccps3+wgbkUploGNElswB2SI8p0gH
TLSH
T1C4C25B36EC58CAB7ECE34F99A74A3507DEE04227868C9AE4C9DD6E5D00D71DC930B816
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 25KB
SHA256 84f5aff5bf510c4811f531aaae87ca843a2f29cda9788ee969bf5676b051de36
MD5 2d4ad9275b3f225acdc4c6f8dab466a1
SHA1 f302a6d88ab86689b9212812336f413799a4ebad
SHA512 e3d341ada847d230a9047aab9b42850d3e90023253f349525d2d38638e6c35ce9544bfc1af3454dfa19dd0a510dccd776fd1358b75570352696e0c39de06ccf0
SSDEEP 384:npziF9CcmyWCs3sNx8TUNTUlIm2QckCr9lDKphiftGNZO0saDBSp6e4KV8p054HH:peFccps38wgbkUZkoGNEsBdI8p0gH
TLSH
T1D6B26D36EC68CEB7ECE74F99B74A7A07DEE01227859C59E4CAD81E0D00971DC530B826
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 28KB
SHA256 4e18c2a12ad97d7ab58c2fb06b4cd271d8d8eb7ee58c666e3b31adf34b777e80
MD5 f5a5b6b373b6b27fb5b0823f9b1bbabb
SHA1 60e6078c6f31c21815303b1a052cedf2f20d6209
SHA512 a2f9e034533cd319f2eb08ae663c6a6948a4f78abbaf6c81c3a9cb9001c1a4aa1728bffb1b61eefe36a11ad5eaf3a9710640b1c09b2005a11e6bf81ada1a7e81
SSDEEP 384:npOiFiZcIV3sNL8TUNTUlI4hQckCrzS1KphiftGNZO0saBkyr8B2SnTKwBODNZO5:plFQV3uwgAk9koGNEls8B2SnewBKZOfx
TLSH
T16DD25A32E868CAB7EDE75F89A74A3607DEF44263D58C5AE8D5DD6E1C009719C030BC26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 534db902a46b0b89c644272300c7f52ebadfa2633bd0f677683f787f853b3dd6
MD5 5cd8906743598e3388ec5692a3e85a6b
SHA1 fce27f806df7662b9f1c9bd3df19b55ca5d8dc60
SHA512 75fef2185ee7865ebb7345f5150b6912997794cf695b2237c5d648f6a4aae90a032a48249ae05b42490b5fa6eddc1ec1df5c01eb7d58aabeb81962131781d83c
TLSH
T103412C58A6EA1148B3B77E5A9BF7A42D447FBD772F0BD49D10010E8E0666A00C871B37
MD5 SHA1 SHA512 TLSH

Submit Download

memory/2152-372-0x0000024BEDBF0000-0x0000024BEEBF0000-memory.dmp

Download