hxxp://rsc[.]org | Triage™

Analysis

user interaction
yes
max time kernel
149s
max time network
145s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
04/08/2026, 09:43

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
http://rsc.org
Sample260804-lp8beaha36

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4432	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134303102237919078"	msedge.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-668679576-120646659-2289335452-1000\{B6BD9341-168F-40E2-95EF-D48BFFB8A3D0}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
5012	msedge.exe
5012	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
3936	msedge.exe
3936	msedge.exe
3936	msedge.exe
3936	msedge.exe
3936	msedge.exe
3936	msedge.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
3936	msedge.exe
3936	msedge.exe
3936	msedge.exe
3936	msedge.exe
3936	msedge.exe
3936	msedge.exe
3936	msedge.exe
3936	msedge.exe
3936	msedge.exe
3936	msedge.exe
3936	msedge.exe
3936	msedge.exe
3936	msedge.exe
3936	msedge.exe
3936	msedge.exe
3936	msedge.exe
3936	msedge.exe
3936	msedge.exe
3936	msedge.exe
3936	msedge.exe
3936	msedge.exe
3936	msedge.exe
3936	msedge.exe
3936	msedge.exe
3936	msedge.exe
3936	msedge.exe
3936	msedge.exe
3936	msedge.exe
3936	msedge.exe
3936	msedge.exe
3936	msedge.exe
3936	msedge.exe
3936	msedge.exe
3936	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
3936	msedge.exe
3936	msedge.exe
3936	msedge.exe
3936	msedge.exe
3936	msedge.exe
3936	msedge.exe
3936	msedge.exe
3936	msedge.exe
3936	msedge.exe
3936	msedge.exe
3936	msedge.exe
3936	msedge.exe
3936	msedge.exe
3936	msedge.exe
3936	msedge.exe
3936	msedge.exe
3936	msedge.exe
3936	msedge.exe
3936	msedge.exe
3936	msedge.exe
3936	msedge.exe
3936	msedge.exe
3936	msedge.exe
3936	msedge.exe
3936	msedge.exe
3936	msedge.exe
3936	msedge.exe
3936	msedge.exe
3936	msedge.exe
3936	msedge.exe
3936	msedge.exe
3936	msedge.exe

Suspicious use of WriteProcessMemory 39 IoCs

description	pid	Process	procid_target
PID 3936 wrote to memory of 3396	3936	msedge.exe	86
PID 3936 wrote to memory of 4432	3936	msedge.exe	87
PID 3936 wrote to memory of 3240	3936	msedge.exe	88
PID 3936 wrote to memory of 3240	3936	msedge.exe	88
PID 3936 wrote to memory of 3240	3936	msedge.exe	88
PID 3936 wrote to memory of 4444	3936	msedge.exe	89
PID 3936 wrote to memory of 4444	3936	msedge.exe	89
PID 3936 wrote to memory of 1020	3936	msedge.exe	90
PID 3936 wrote to memory of 368	3936	msedge.exe	91
PID 3936 wrote to memory of 1020	3936	msedge.exe	90
PID 3936 wrote to memory of 1020	3936	msedge.exe	90
PID 3936 wrote to memory of 368	3936	msedge.exe	91
PID 3936 wrote to memory of 368	3936	msedge.exe	91
PID 3936 wrote to memory of 1076	3936	msedge.exe	93
PID 3936 wrote to memory of 1076	3936	msedge.exe	93
PID 3936 wrote to memory of 1076	3936	msedge.exe	93
PID 3936 wrote to memory of 1396	3936	msedge.exe	94
PID 3936 wrote to memory of 1396	3936	msedge.exe	94
PID 3936 wrote to memory of 1396	3936	msedge.exe	94
PID 3936 wrote to memory of 916	3936	msedge.exe	97
PID 3936 wrote to memory of 916	3936	msedge.exe	97
PID 3936 wrote to memory of 916	3936	msedge.exe	97
PID 3936 wrote to memory of 2532	3936	msedge.exe	99
PID 3936 wrote to memory of 5032	3936	msedge.exe	100
PID 3936 wrote to memory of 2532	3936	msedge.exe	99
PID 3936 wrote to memory of 5032	3936	msedge.exe	100
PID 3936 wrote to memory of 2036	3936	msedge.exe	102
PID 3936 wrote to memory of 1424	3936	msedge.exe	106
PID 3936 wrote to memory of 2656	3936	msedge.exe	107
PID 3936 wrote to memory of 4252	3936	msedge.exe	108
PID 3936 wrote to memory of 4268	3936	msedge.exe	109
PID 3936 wrote to memory of 4268	3936	msedge.exe	109
PID 3936 wrote to memory of 844	3936	msedge.exe	110
PID 3936 wrote to memory of 844	3936	msedge.exe	110
PID 3936 wrote to memory of 1780	3936	msedge.exe	111
PID 3936 wrote to memory of 1780	3936	msedge.exe	111
PID 3936 wrote to memory of 688	3936	msedge.exe	118
PID 3936 wrote to memory of 688	3936	msedge.exe	118
PID 3936 wrote to memory of 5012	3936	msedge.exe	119

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument http://rsc.org
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3936
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x248,0x7ff967a6c188,0x7ff967a6c194,0x7ff967a6c1a0
  2⤵
  PID:3396
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1896,i,9770081923559084617,10970468798619607455,524288 --field-trial-handle=2264,i,8508593338975171585,4258322704749172152,262144 --variations-seed-version --mojo-platform-channel-handle=2292 /prefetch:3
  2⤵
  - System Time Discovery
  PID:4432
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1704,i,2382748212622122911,8740010603990113757,262144 --field-trial-handle=2264,i,8508593338975171585,4258322704749172152,262144 --variations-seed-version --mojo-platform-channel-handle=2260 /prefetch:2
  2⤵
  PID:3240
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2560,i,12662008524008264435,4546330852281890137,524288 --field-trial-handle=2264,i,8508593338975171585,4258322704749172152,262144 --variations-seed-version --mojo-platform-channel-handle=2572 /prefetch:8
  2⤵
  PID:4444
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3488,i,5968867758001615022,7122888967031811487,2097152 --field-trial-handle=2264,i,8508593338975171585,4258322704749172152,262144 --variations-seed-version --mojo-platform-channel-handle=3516 /prefetch:1
  2⤵
  PID:1020
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3508,i,13157327289832068883,12803805727561516543,2097152 --field-trial-handle=2264,i,8508593338975171585,4258322704749172152,262144 --variations-seed-version --mojo-platform-channel-handle=3524 /prefetch:1
  2⤵
  PID:368
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4240,i,13711408331763133755,18089954071724063168,2097152 --field-trial-handle=2264,i,8508593338975171585,4258322704749172152,262144 --variations-seed-version --mojo-platform-channel-handle=4244 /prefetch:1
  2⤵
  PID:1076
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4252,i,11641869607272525001,12749617767634145225,2097152 --field-trial-handle=2264,i,8508593338975171585,4258322704749172152,262144 --variations-seed-version --mojo-platform-channel-handle=4268 /prefetch:2
  2⤵
  PID:1396
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=3476,i,6063777396699415502,21630489503147812,2097152 --field-trial-handle=2264,i,8508593338975171585,4258322704749172152,262144 --variations-seed-version --mojo-platform-channel-handle=5076 /prefetch:1
  2⤵
  PID:916
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3508,i,13474484779726708800,994008885521456741,524288 --field-trial-handle=2264,i,8508593338975171585,4258322704749172152,262144 --variations-seed-version --mojo-platform-channel-handle=3732 /prefetch:8
  2⤵
  PID:2532
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3600,i,8518839357253352932,12256540841671985275,524288 --field-trial-handle=2264,i,8508593338975171585,4258322704749172152,262144 --variations-seed-version --mojo-platform-channel-handle=3752 /prefetch:8
  2⤵
  PID:5032
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5900,i,3306312645545644073,5925695567315854326,524288 --field-trial-handle=2264,i,8508593338975171585,4258322704749172152,262144 --variations-seed-version --mojo-platform-channel-handle=5916 /prefetch:8
  2⤵
  PID:4580
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5900,i,3306312645545644073,5925695567315854326,524288 --field-trial-handle=2264,i,8508593338975171585,4258322704749172152,262144 --variations-seed-version --mojo-platform-channel-handle=5916 /prefetch:8
  2⤵
  PID:2036
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3484,i,13713001968769428263,5179752181116040128,524288 --field-trial-handle=2264,i,8508593338975171585,4258322704749172152,262144 --variations-seed-version --mojo-platform-channel-handle=4484 /prefetch:8
  2⤵
  PID:1424
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4272,i,17129920550471648384,12466738590424081844,524288 --field-trial-handle=2264,i,8508593338975171585,4258322704749172152,262144 --variations-seed-version --mojo-platform-channel-handle=4476 /prefetch:8
  2⤵
  PID:2656
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3684,i,12072212308725856261,8245533896516113400,524288 --field-trial-handle=2264,i,8508593338975171585,4258322704749172152,262144 --variations-seed-version --mojo-platform-channel-handle=5972 /prefetch:8
  2⤵
  PID:4252
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2896,i,4931803463465008122,7173708505063645054,524288 --field-trial-handle=2264,i,8508593338975171585,4258322704749172152,262144 --variations-seed-version --mojo-platform-channel-handle=4044 /prefetch:8
  2⤵
  PID:4268
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5308,i,4854491161253284381,7857796367800111971,524288 --field-trial-handle=2264,i,8508593338975171585,4258322704749172152,262144 --variations-seed-version --mojo-platform-channel-handle=6456 /prefetch:8
  2⤵
  PID:844
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6516,i,9726494119919618285,5053581941520304108,524288 --field-trial-handle=2264,i,8508593338975171585,4258322704749172152,262144 --variations-seed-version --mojo-platform-channel-handle=5856 /prefetch:8
  2⤵
  PID:1780
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=760,i,4360121408298045301,10722788237325277879,524288 --field-trial-handle=2264,i,8508593338975171585,4258322704749172152,262144 --variations-seed-version --mojo-platform-channel-handle=6420 /prefetch:8
  2⤵
  PID:688
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1848,i,7605562719519210415,7897145593325732262,262144 --field-trial-handle=2264,i,8508593338975171585,4258322704749172152,262144 --variations-seed-version --mojo-platform-channel-handle=6168 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5012

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:2800

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

blocklist

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\blocklist
Size 105KB
SHA256 17d500b4417e92837c05a8187f43f060e09191612c25892f2c54e786bd254c36
MD5 ca52a84f03e904e79c2a5651b273e5fe
SHA1 61ddeaf1850d81986389db97ff9470b67eb8cb1d
SHA512 d1f489b74d4da21280e354fdfd91d6569edfcb1abc7f4f6740756bbe744f02bd51136d5ea47c7a6a1842683dc3eba0d2608d4d46e5eb8ffb5035ffeb98f9c788
SSDEEP 1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P7G:fwUQC5VwBIiElEd2K57P7G
TLSH
T1B9B3B931457E36BF26E93EE828CF1511B84F3912664895D4ABE1FE2C4845E68633CEF4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CrashpadMetrics-active.pma

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\CrashpadMetrics-active.pma
Size 16KB
SHA256 814d47aad78c212b52568b9c7b58d242899d490d3afebce66181cae50c880df5
MD5 8c7cdfea4284ba987d295d82a9c7ddd6
SHA1 7d1a3a66f2d64a383b230196ba89a263ce7ee957
SHA512 59c8229e834c944265aed4131c79f41f9f940a48651b9fb18800cef5bae36d17c7fd5880120c6fee8ce22a157b65bc63846b65765bc4dc86e15926dcce400d0d
SSDEEP 12:sf9iXhV0xoUZxCe+JKlkQuMRxCb8TXuYJ0IJpPK6BsyW1inPiz:U9iRqxoUZxWMk8xVTeYWI31BtXP
TLSH
T105724C85B34498FFC8835E7189BD27903774F6DF1F02866B6A6A760E2E271C84F44224
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 5d2c4e39ddbeb0ac61628bae04f1ac5787600ec893b0e230d1a84d61470771a9
MD5 cd6e704306442404371caebfec7f5b29
SHA1 e4beab8b7820af3633bf7c75a5498a958a95832e
SHA512 de66681a9245e8ece7d7e2ea2080251c395f2aeb8a885ac007eaf16f2ee3a3e36610d2afc17be964a038704371cedfbe4da91143ebed5adac20dbda97768d6e6
TLSH
T13AD080273A196404F7964175A483D7061319956129579712F310C44C99775D553C11C2
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 1c8e6fcbb66aba64fe595f222fc4117e00e82ccdc0eef2100a1b4f7babb04f87
MD5 398d1e7948d46a763209c466fdacd0fb
SHA1 b26f2c32bc106089a59ce779d792beaba59f92bf
SHA512 a0bbf31d803e7333d004f03de9c261732d00cceb5d82dd64b5f0decf8adc8b840891187c72bb21cce83873e6d4dd2fab89d4c7efa320afe2ef3589678dcb1424
TLSH
T1B6D080277A196004F3964175A483D7061319956129575711F310C44CA9775D553C11C2
MD5 SHA1 SHA512 TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 331B
SHA256 f4bf8e846d71d222468eaebaa8d10a166e6a63b3c665e83a8923bc20295c8369
MD5 edd2710ea16906c97517049318b96081
SHA1 e6d03a54b5e5dd9dccaefcbe4092510ee054f0b8
SHA512 3de055570bbe3329b70ff348779a5abafcb580efb464367b0220fea18cebf94b3a5190dc743333b0eb88edcb861d7bf2b3ba9e8fb661f0b95d6deee445a517a1
TLSH
T11EE07DC804C8C3BEE71468AB527C530D82E1370EEFC8A98A37088C8D7005050F6C6AE4
MD5 SHA1 SHA512 TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 331B
SHA256 f21c3154cd09358ed5c20061a932d08c5b8e2876f139dd2dd81a1ea87f5ebfc3
MD5 330b05f56c73afe84ac6317fdb981fc4
SHA1 039920104e1a04c817bea55bedc0d2cea567463a
SHA512 bc320bf05dbd4dcbae3eb91ab0478a2438b9bef3bd6c52c316ced6fd3bd9b0ae009fac4d8c1f068d65f6660fd19c9938b24948afd4011e362f31105a58bf3b09
TLSH
T118E07D8418C8C23EAA00A49751F87B8C82C0370EDEC8AD8A17008C887046468BBEBBF4
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 78a3c2e03c3f9a9ce2fa177250a512540441734e6c919e656e14681f9cf28c1b
MD5 fb19d3831c77365a88bb4b489a1351c1
SHA1 a485c56a0de925acd365c0e4ab8efbda0980db1f
SHA512 fb9f323311253132ebfbc2f67bd3e1bebf4f679863b3244d19262fb6648728bdd635084afe3718f1de53da6df745c5b9dbe9117ca173a64fdc201859d8dbd04a
TLSH
T167717D351D714F52EBD402BF64E3F210757A85E4FA131E79C960AB3E2B1C79802ABC56
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe586cfd.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe586cfd.TMP
Size 3KB
SHA256 28226b6d3b164a100c11caf88ca4f917d876c0a1b3b3f25279d6bcc5cd951434
MD5 09ca8f073592a824fe197fc4b8a6f9dc
SHA1 100ae0f4cf34e7745b689d1a4da669370ee38860
SHA512 5ebdf777a5630a933e2ecaef7ae5138afac3093f22fb7a8549c032a9b4e01405da3dc89c8538793e2c96261cbd86493c3a393c69392c64e8cf77c54c15fdecba
TLSH
T1CF717C350D714F42EBD401BF64E3F210717A85D8FA131E79C9606B3E2B1C79802ABC56
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 1KB
SHA256 ab094c413e70446952c147bfba6cf12d6fe4ee9bf7d753f0ff7d4d04a8950c19
MD5 26cf084bb74812308d62bacc604556e5
SHA1 895f034c9ab6d893728ca4399ea0e0ded55c6643
SHA512 0ad1219182afd9d79d5d663ee24e3448360ace43d5bc6531fca637c260eafa3dc2829e9fcca0e206f71a3f38bab9fa66f93014b05718a22879f84273b4e8cee9
TLSH
T199217CF783F4856E8A1156F09A14AE1BCE1E0506436C7C1685E4BF2B93F3465E10195F
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 580220050371415bc97d6a148c361e5e84af7eef377789f35603d027ed90c56a
MD5 9f4ca86fc75f4c1bddc1e90b9c7b4e7b
SHA1 9e672448a015b99494eb9297a59565cfb3059fec
SHA512 7cc4d417b7f1be89529b39f4c1bc48ccdf2494619fdaf14c1d7183af1061ce5dead0e527322929b0a7e64d4c09b610d7942836bc20ea2dd9ff3cbe4b66883b40
SSDEEP 192:sxZaRXyM/jK1Ml8MkN/f1stjrIdpnIHW6+WNhEk/YCQ0rs+0IgrJ:sxZaFMN/f1stj0IHbd/lsH9
TLSH
T113420711AA349977CCDBD209FA45BF53D6F915B292900E54AAFCDA1C00E6FEC221781F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 ff5318d4061eeb3b68747b5b0eaeb3553a2ef8cdb48b4adfb17de145e05975af
MD5 49b99b9d269a445c87e99d9d7f5ff5c2
SHA1 9e461a8dd83775e00b9adee55e7df77199f05819
SHA512 c772a1c9a4c81d6704f4743a4c7ca3b37a997c09cc1f61294660dc687c56f169dd86230caf6fc9134e3d5b853292046809607c642703fbc80e00c8c187da82f4
SSDEEP 192:sxZaRXyM/jK1Ml8UQhkN/f1sburIdpJIHW6+WNhEk/YCsMFrs+0Ig5zJ:sxZaFqyN/f1sbu0yHbd/jsHP
TLSH
T16152E811AA385977CCDBE209F945BF53D6F954B292900E44AAFCDA1C00E6FED221781F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 30KB
SHA256 f5fe12c25c0a708d374c17237a5e7f8b5364156ecf3ba40ee4062523f7d55048
MD5 97aaa896275d413cf4852fe7da8ef927
SHA1 5717a7ba876b21c00b6863fd293a3aa0044e8ad8
SHA512 2ea76ee1f1e3708f92a7f6265bcd12e092d78ce3a3a6bd3dcede8bf79e806059d7d1344164e1d07ea8e1c77a5aff3f658d2fb277095e132dc74a8a1fd3db85fd
SSDEEP 768:o98bqn+WvSCt68F1+UoAYDCx9Tuqh0VfUC9xbog/OVnZLlRTKVbrow:o98bqn+WvSCt6u1jaCZLbWVow
TLSH
T10DD20A3B280CCB7E4F845E5DED266F962DD801CB6B988D4447FA884C03C76EA512B5DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 2259ea7bea0030f4744a348c2d59181d2532097605e5ccc68ac1bbe7fefedbda
MD5 a0a7167a203c7ba03701944b36e72676
SHA1 9cc0a050eaa06f5ae49e0e38dc6fadabff5609a4
SHA512 8eb8a62871c23c0fb17d24359dacfba9aeaccbe877b38c8b03ceb60918ca8694aa537fcbc36f31c89f9a68ce74a28cb7c9fe8bcc4ddddc429eeb1cd13a9913ab
SSDEEP 96:KcOUKnqCKAwKxqmhZsLfZb7xG/2sEnxK84E5xoBJen7h8LfhbK:invrhZsLfZb7o/2Ln94E5OBJen7h8LfU
TLSH
T1D0914402713B228138FE290CA29396768E4272633818646F7FF944560E7AF515EFDCDD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig~RFe5908ff.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig~RFe5908ff.TMP
Size 3KB
SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
MD5 904e6e94a1d46374c8630cfd86cc729f
SHA1 e1d9c3f7813878acc6510d48d95b2bf48b2e1a0d
SHA512 081e2a26252860ff8d8f7a9d0378ae56f0cc50574d13d2a121afdf74284963747ef874a4d73b1df7774cd8570972f4f513eefe0a0325fd088556d5b1ba946712
TLSH
T1DB815C4FCC0CBE77ABAB6A719A35D6B2F79131EA94518A977F8C444EE3050ED0242E50
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 19KB
SHA256 eed3f6b73156dddf3cc86b4e4f64327fcaf40e854f48003295db68839f5e5931
MD5 07306f0e8fd12558c38f23c7c1494278
SHA1 b072f64894cd9927604ace65be0efaaab2647fd3
SHA512 f011fae531c4b5a5e7be7369ad581a43ceca2ef2a07d8e1e2f24d17f9b9c32948bc0e12c92b34d08b688947cacc4101b546a74c92e839c95fbd813850a15759f
SSDEEP 384:3ZcIhsNXUgnxY39GTQWhEa+5OHfaXFj8QBeRs9JKgqijU79:/hmxY39yKaYOH898QTjKgqmU79
TLSH
T1E6928E3168385D7799A6B5C6F88A3B1B4FF89067D6886FD0D1DC6F0C01D699C231F826
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 6af7a9dd04513a945f88852f92df3e8a298c250057492ad798b117623964a485
MD5 3909c899090a51666928abdf49528e40
SHA1 a623411591cce5769068923444acf5082db9e4b0
SHA512 f676f8c1b0f8d20229d2d2f13db407b197da3cdf44f9aa554d6358eb17092996f3f7b944191bae4ec931aab9541ba8ea740c286bee92cd80bf97608e69867cf7
SSDEEP 192:vONm6Db6QmiUy9VHBa+j9OmaftmH+Rgc6U6:vONm6uiHBa+5OHfalnU6
TLSH
T1DA02F93569386CB79EB2AE49F48B3B279F94207BD9562F84DAD81F0C00D765C2307827
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 20KB
SHA256 898210e5987ca447e2cdff7b01416374f025344250f4503edfecdb2bf1295061
MD5 715b45c92162a2f69b24ac54279e63d5
SHA1 ab808b004a1bea85b3d9d35dd5aadf1b0b016de2
SHA512 8dd84ae5316aa1c0b6b3fa1388e8c561ecf9df633049cf077affa299d1bb81d63c8d7ac1bf6076de261a228c652800be360972a1aad554625429d5ab71efc93a
SSDEEP 384:wZcIhsNXU9nxY39GTQWhEa+5OHfaXFj8QBeRs9JKgqijU79:OhpxY39yKaYOH898QTjKgqmU79
TLSH
T164928E3128385D7799A6B5C6F88A3B1B4FF89067D6886FD0D1EC6F0C01D699C231F826
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 27KB
SHA256 f18e81ce8d9aa756b97924312194bee889df5f3e0eef14895f51f3083b9c918a
MD5 68dd72a27738b0738032f673d4f66028
SHA1 54ec8910b9350e68288c43579ebd67d722c81594
SHA512 0f79f059750025f72c40a47bd33ad93995867606e9eb4a1a8911ee94150809e28389f4ed6875b0918ca0c05d6a22b289d9cf119971277d16392ea0e98b4f96c6
SSDEEP 384:EiFiZcIMzsNM8TUNTUlIl9nxY39GTQhhEa+5OHfaXFjdQBeRs9JKgqijU79:fFQwlwgDxY39NKaYOH89dQTjKgqmU79
TLSH
T154D23BF204E78936D9AE5787A77D2E074EBDC053F584AA90B3D85A0CCC865BFD30A815
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 f51cc89e271d57cf8a62544a5b0ce305e70cac09408af2433d1c4f02826f967e
MD5 f6e1f91b0096afdf6243284bae1a820b
SHA1 a2dc7661fb4e4a34d42feffe817ed899b30367e8
SHA512 487e2ee530b4ccf2d5440e88725aaa44c23235c562ad4339362960266edd32de8546fe9de47cfecdc1b34135fa4e94b5ac256beff375663a32c5753e59fc8fc8
SSDEEP 192:hONV6DbZQmiUySVTBa+j9OmaftmHXFgE0Nz2qkU6:hONV6PLTBa+5OHfaXFj0QU6
TLSH
T15A123A3278389C675EA1A589F4CB36179EA55167DA4E7F80D6CC2F0C01DBA9C230BC26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

efb4c968-a94a-48d7-ad02-4fea48e4b539.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\efb4c968-a94a-48d7-ad02-4fea48e4b539.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 74a4df288e1abf0ace66984eb5213b9216fb3eb93938ff3dce540a581b92f781
MD5 476c6802a0d287145c7960c46ed1f470
SHA1 a27983fe84eac5afed00aaf4843ece66fdb27c87
SHA512 5564989b0771ec07c0a406f612b9b09d3a9e1a4e1ee3c44724a279878981eb16c586c9ed15a6c5ea4385ffab82cd74a9f86cb116410a5fa5309b7a0b5e666852
TLSH
T193410658AAF91108B3B76F59AFF6696D487EB9773E0AE45D00110D4F0A62B40CD72733
MD5 SHA1 SHA512 TLSH

Submit Download