hxxps://product-management[.]freshservice[.]com/helpdesk/dashboard

Analysis

user interaction
yes
max time kernel
148s
max time network
147s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
04/08/2026, 17:15

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://product-management.freshservice.com/helpdesk/dashboard
Sample260804-vsqefatsav

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4212	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134303373334421775"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1074038928-2032447174-945360078-1000\{9C040C5B-D756-496D-B637-2D1A41F5F214}	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3960	msedge.exe
3960	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
4352	msedge.exe
4352	msedge.exe
4352	msedge.exe
4352	msedge.exe
4352	msedge.exe
4352	msedge.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
4352	msedge.exe
4352	msedge.exe
4352	msedge.exe
4352	msedge.exe
4352	msedge.exe
4352	msedge.exe
4352	msedge.exe
4352	msedge.exe
4352	msedge.exe
4352	msedge.exe
4352	msedge.exe
4352	msedge.exe
4352	msedge.exe
4352	msedge.exe
4352	msedge.exe
4352	msedge.exe
4352	msedge.exe
4352	msedge.exe
4352	msedge.exe
4352	msedge.exe
4352	msedge.exe
4352	msedge.exe
4352	msedge.exe
4352	msedge.exe
4352	msedge.exe
4352	msedge.exe
4352	msedge.exe
4352	msedge.exe
4352	msedge.exe
4352	msedge.exe
4352	msedge.exe
4352	msedge.exe
4352	msedge.exe
4352	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
4352	msedge.exe
4352	msedge.exe
4352	msedge.exe
4352	msedge.exe
4352	msedge.exe
4352	msedge.exe
4352	msedge.exe
4352	msedge.exe
4352	msedge.exe
4352	msedge.exe
4352	msedge.exe
4352	msedge.exe
4352	msedge.exe
4352	msedge.exe
4352	msedge.exe
4352	msedge.exe
4352	msedge.exe
4352	msedge.exe
4352	msedge.exe
4352	msedge.exe
4352	msedge.exe
4352	msedge.exe
4352	msedge.exe
4352	msedge.exe
4352	msedge.exe
4352	msedge.exe
4352	msedge.exe
4352	msedge.exe
4352	msedge.exe
4352	msedge.exe
4352	msedge.exe
4352	msedge.exe

Suspicious use of WriteProcessMemory 35 IoCs

description	pid	Process	procid_target
PID 4352 wrote to memory of 3152	4352	msedge.exe	85
PID 4352 wrote to memory of 4212	4352	msedge.exe	86
PID 4352 wrote to memory of 2392	4352	msedge.exe	87
PID 4352 wrote to memory of 2392	4352	msedge.exe	87
PID 4352 wrote to memory of 2392	4352	msedge.exe	87
PID 4352 wrote to memory of 3812	4352	msedge.exe	89
PID 4352 wrote to memory of 3812	4352	msedge.exe	89
PID 4352 wrote to memory of 2244	4352	msedge.exe	91
PID 4352 wrote to memory of 2244	4352	msedge.exe	91
PID 4352 wrote to memory of 2244	4352	msedge.exe	91
PID 4352 wrote to memory of 3104	4352	msedge.exe	90
PID 4352 wrote to memory of 3104	4352	msedge.exe	90
PID 4352 wrote to memory of 3104	4352	msedge.exe	90
PID 4352 wrote to memory of 844	4352	msedge.exe	92
PID 4352 wrote to memory of 844	4352	msedge.exe	92
PID 4352 wrote to memory of 844	4352	msedge.exe	92
PID 4352 wrote to memory of 868	4352	msedge.exe	93
PID 4352 wrote to memory of 868	4352	msedge.exe	93
PID 4352 wrote to memory of 868	4352	msedge.exe	93
PID 4352 wrote to memory of 4828	4352	msedge.exe	97
PID 4352 wrote to memory of 4828	4352	msedge.exe	97
PID 4352 wrote to memory of 4828	4352	msedge.exe	97
PID 4352 wrote to memory of 564	4352	msedge.exe	98
PID 4352 wrote to memory of 2580	4352	msedge.exe	99
PID 4352 wrote to memory of 564	4352	msedge.exe	98
PID 4352 wrote to memory of 2580	4352	msedge.exe	99
PID 4352 wrote to memory of 3820	4352	msedge.exe	101
PID 4352 wrote to memory of 1912	4352	msedge.exe	106
PID 4352 wrote to memory of 4116	4352	msedge.exe	107
PID 4352 wrote to memory of 4568	4352	msedge.exe	108
PID 4352 wrote to memory of 1948	4352	msedge.exe	115
PID 4352 wrote to memory of 1948	4352	msedge.exe	115
PID 4352 wrote to memory of 2532	4352	msedge.exe	116
PID 4352 wrote to memory of 2532	4352	msedge.exe	116
PID 4352 wrote to memory of 3960	4352	msedge.exe	117

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://product-management.freshservice.com/helpdesk/dashboard
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4352
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x248,0x7ffb6771c188,0x7ffb6771c194,0x7ffb6771c1a0
  2⤵
  PID:3152
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1852,i,13783784640055450975,14715409249409685445,524288 --field-trial-handle=2976,i,6553735606521317274,4671000047281505642,262144 --variations-seed-version --mojo-platform-channel-handle=3020 /prefetch:3
  2⤵
  - System Time Discovery
  PID:4212
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1768,i,4134373697433884300,3481150376996076813,262144 --field-trial-handle=2976,i,6553735606521317274,4671000047281505642,262144 --variations-seed-version --mojo-platform-channel-handle=2972 /prefetch:2
  2⤵
  PID:2392
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2284,i,16369549055428455810,12937939130808674841,524288 --field-trial-handle=2976,i,6553735606521317274,4671000047281505642,262144 --variations-seed-version --mojo-platform-channel-handle=3148 /prefetch:8
  2⤵
  PID:3812
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3448,i,6409035467660862249,15560861589293106233,2097152 --field-trial-handle=2976,i,6553735606521317274,4671000047281505642,262144 --variations-seed-version --mojo-platform-channel-handle=3524 /prefetch:1
  2⤵
  PID:3104
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3488,i,13083352658624667220,10929383413641272935,2097152 --field-trial-handle=2976,i,6553735606521317274,4671000047281505642,262144 --variations-seed-version --mojo-platform-channel-handle=3548 /prefetch:1
  2⤵
  PID:2244
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4200,i,14534019565065424028,9335047428374502644,2097152 --field-trial-handle=2976,i,6553735606521317274,4671000047281505642,262144 --variations-seed-version --mojo-platform-channel-handle=4160 /prefetch:1
  2⤵
  PID:844
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4212,i,8903824505860985851,5857438215397522813,2097152 --field-trial-handle=2976,i,6553735606521317274,4671000047281505642,262144 --variations-seed-version --mojo-platform-channel-handle=4224 /prefetch:2
  2⤵
  PID:868
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=5088,i,17714889796673377482,14315872946836610477,2097152 --field-trial-handle=2976,i,6553735606521317274,4671000047281505642,262144 --variations-seed-version --mojo-platform-channel-handle=5128 /prefetch:1
  2⤵
  PID:4828
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3544,i,5077489192204310891,14292178486877651700,524288 --field-trial-handle=2976,i,6553735606521317274,4671000047281505642,262144 --variations-seed-version --mojo-platform-channel-handle=3620 /prefetch:8
  2⤵
  PID:564
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3676,i,4603006887048552133,9070583669644283134,524288 --field-trial-handle=2976,i,6553735606521317274,4671000047281505642,262144 --variations-seed-version --mojo-platform-channel-handle=3572 /prefetch:8
  2⤵
  PID:2580
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5840,i,4351277909588272625,12525850124344339870,524288 --field-trial-handle=2976,i,6553735606521317274,4671000047281505642,262144 --variations-seed-version --mojo-platform-channel-handle=5868 /prefetch:8
  2⤵
  PID:4808
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5840,i,4351277909588272625,12525850124344339870,524288 --field-trial-handle=2976,i,6553735606521317274,4671000047281505642,262144 --variations-seed-version --mojo-platform-channel-handle=5868 /prefetch:8
  2⤵
  PID:3820
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4944,i,7509203612092593545,11797651553291097976,524288 --field-trial-handle=2976,i,6553735606521317274,4671000047281505642,262144 --variations-seed-version --mojo-platform-channel-handle=4292 /prefetch:8
  2⤵
  PID:1912
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3464,i,12874120083650237138,11997045341247471958,524288 --field-trial-handle=2976,i,6553735606521317274,4671000047281505642,262144 --variations-seed-version --mojo-platform-channel-handle=4716 /prefetch:8
  2⤵
  PID:4116
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4936,i,16280014297363302486,1000819098163863433,524288 --field-trial-handle=2976,i,6553735606521317274,4671000047281505642,262144 --variations-seed-version --mojo-platform-channel-handle=4952 /prefetch:8
  2⤵
  PID:4568
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5464,i,1385444221871513096,11881011480280404719,524288 --field-trial-handle=2976,i,6553735606521317274,4671000047281505642,262144 --variations-seed-version --mojo-platform-channel-handle=5428 /prefetch:8
  2⤵
  PID:1948
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3920,i,17175275276478842003,8799551331801012962,524288 --field-trial-handle=2976,i,6553735606521317274,4671000047281505642,262144 --variations-seed-version --mojo-platform-channel-handle=5456 /prefetch:8
  2⤵
  PID:2532
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=3540,i,7388092346654216193,14033696753600862959,262144 --field-trial-handle=2976,i,6553735606521317274,4671000047281505642,262144 --variations-seed-version --mojo-platform-channel-handle=6132 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3960

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:4072

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

blocklist

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\blocklist
Size 105KB
SHA256 19770e7fe2094711e80964a836e60964de6a8ad16ccaac3d8dfad98369019638
MD5 44dad74e010b183434bee387e897e5a5
SHA1 1e8cd1a25c1805f95db825d1abc631a4dc4b3528
SHA512 4bbc70e7b7329e93d20b196e728888ea0151b121d95738e26f908478d84bd38ac8410bda7f62d907ab7d1206a6ca2df9c6c71f59ce1ad6ea772dbae5c26236d5
SSDEEP 1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P73:fwUQC5VwBIiElEd2K57P73
TLSH
T1CEB3B931457E36BF26E93EE828CF1511B84F3912664895D4ABE1FE2C4845E68633CEF4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 85da5d101c008762046da9670ca95944217bbb1829e60a748f367ee4f9926b13
MD5 ef105d8d3e87a813544857290c28833d
SHA1 bfe7010cf80fb8cbcb9eeb5e0d0b551ece0b3134
SHA512 ae71c302652e2de890fca25723381f403f4f9ee51e2da6583977318de3e7ff00defb73b202e17a287def3ff618de86c0af96c0fca7729ef3efe0a4ba3cfdfc63
TLSH
T16FD0803377C9A100F6567375F413C7412F27057415868613A168C45CDC784C557C92C7
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 98eae6fcc56d922689f3a45ab65635857e6510c437555d4eae3a6cd68dff3acb
MD5 338a3c92e96cad1510815c958fc76de7
SHA1 e1234ace09aad728f9bde0798e2fb22ee82583de
SHA512 e29c9087bb4c9c94c8525a95c307117f14827336de29aa01f837bd02b05b3aecd1c1771970519a60972a1495e05b4f68ab34cf5e4ec9d7060f6383ac019c2ed7
TLSH
T17DD0803337C9A500F6567375F412C7412F2705741586C713A168C45CDC794C557C92C7
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 31c106d1fbcaa7aeae374f70b9660673859f3a17c8785f7f37e3c8820f79d522
MD5 d6a6e9a1edeed730679c92275121c519
SHA1 0bec9f7dc9cdf796b8f6e2b920a5f9bf457888bb
SHA512 9335556630b13962623988eee94eff173480ecf28d451fe3fadce43c7a256222929fb3fbd9ea9ea75700804ad152e24cdcc558f7c83ebcd6db5670b8f0459e75
TLSH
T19771E915197290B3EB243C31E1D93E9734FF88A83E9F5FE601D1457FA60A7A6E411834
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5887b9.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe5887b9.TMP
Size 3KB
SHA256 51fb6e13e304dfec179c8cdc17b27f3c485c3b838d5e57e7d2f08f624087580b
MD5 c4d26f494bbd4a1dc6f9d9a90801a795
SHA1 52c235de06ac3e3d29e7903ea9f93b8713aa0a5d
SHA512 64c220d31c820b8f54f4411797481b7f344e3aed613e5217c1c1d36fcf98a1b4ae4a9977454571bb35d275507b437f78e46146a76f1c15ace7dc480111648d43
TLSH
T17D71D815017380B3EB243C31E5D93E9334FF84A83E9F5FA615D1457F9A0A7A6E421834
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 bc34020c47a3943108712b0435a9f95fa8d32528d033a788a4af6d6c8cc1716b
MD5 55c1b6ad6924661b8db8f8d68f939328
SHA1 b212bc85b223e06b246f8d8a47a4df884794e804
SHA512 9bbf6b8aa41e08533c26dfcc36b57c60fbb2e7fb6f8e837d4fb67a1abf83e77387377e182a8d9664133cfff549dbe1d8ec6d1ad644a59e2344605db4dcc67fc4
TLSH
T1A4519EFB47B18A6EAE0192F06E097F1B8E1C0511436C796D85E0AE27A3F34B1E11165B
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 0dc6c14bbfd5434d00ff91cd7d8396ebaead236a394545d61c842f4caa17e3c2
MD5 36c10d0eed763ecdb60d62f0beb6ef9e
SHA1 bbf0fc68399841357df088168168b3165506f8c4
SHA512 058e7528b5885079e340a03131c3fef6891995b75b37b9fe06fa2940912102ce479485f65024a1a2cfac24b3ea7a53b97be26655e24cefca470f4790ebe92d4b
SSDEEP 192:sxZ/REyM/jK1Ml8MkGn/fFsLJbSJqIdpMuHW6+WN5c+c/Y4inucLIgrJ:sxZ/CMGn/fFsBSJjjHb5q/q9
TLSH
T10542F9156A346977CCDBD209FA45BF93D6F91472A2900E58A9FCDA1C04E6BED2203C1F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 7a8f1992170f464a466119ccd9bdbd17fd032a8d73bf669b59d62bc4620de972
MD5 d826f35fc0a3826a2e4ca3dc4f2fe3a4
SHA1 d51eec4c38994a44dd2f62e6b5a05a1301e4c7ed
SHA512 a326eae9f41b36c9d5baffa2407d3ffb32350840c233fe2ec023b5485fbd82c8fae49d119adda5c5322bb6076f677e572a8ac57cd31cf133afb762180a45b5d5
SSDEEP 192:sxZ/REyM/jK1Ml8UQhkGn/fFsaJblJqIdpquHW6+WN5c+c/Y4sAuwLIg5/J:sxZ/qqyGn/fFsilJjxHb5q/7r
TLSH
T13D52E815AA345977CCDBD209FA45BF93D6F91472A2900E58A9FCDA1C04E6BED2203C1F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 50e118b538b84b3fe7560253d9c66dd053a5dd0cf82c8a5b77d51fd4574bdd1c
MD5 8823502d4d96b110268c42b65f3e5d4b
SHA1 96d6b60973821f22ee40bebaf21ed56817c150e4
SHA512 6a8d6840d0b351140e0d8db83466debc1d1adf50c9bae4f2797eac249e5d6c7ec7fc5f4298184c412037d9a251c05dc99e5025308d7a2c7b1ec6dd518e495152
SSDEEP 192:sxZ/REyM/jK1Ml8MkGn/fFsaJblJqIdpMuHW6+WN5c+c/Y4djucLIg5/J:sxZ/qMGn/fFsilJjjHb5q/5r
TLSH
T1E152F815AA345977CCDBD209FA45BF93D6F91472A2900E58A9FCDA1C04E6BED2203C1F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 30KB
SHA256 03b8345cf4d6744f68d9774d007466495bb76c10e08534e17b3d36963f3d6760
MD5 090daf59b6aced6e40e58c733b472b2b
SHA1 58838059500df19e4f19b52ff197b37d3155eecd
SHA512 1ab10d0a2b2c1eb7dd8817fbbaecc6a270f37295111a2b119379324975b831a96ad101fa5778d79fb5d39085093c5e35e38d0f112d87d45ec19a57eea7e745ca
SSDEEP 768:Ue8iJPNWvx76r8F1+UoAYDCx9Tuqh0VfUC9xbog/OVsALl6opdLroWkWUnd:Ue8iJPNWvx76ru1jahALocd4EUd
TLSH
T145D20A3B680CCB7E4F844E9CEC266F966DD801CB6B984D5447FA884C03C76EA51279DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 5KB
SHA256 0e486851910b35b0d86fb148be69525a2ccd7f7f08939ecf729e66f125bd37da
MD5 f4c2c4a49e9111c07e257e5b4170ced4
SHA1 8566bcdafef7ff2a4f35dfa192c3f64c5c9070c5
SHA512 233c4aebae2d207f264773700ad4f56923c5f1712d8715a46252826d566a0610b0bf41cd14dddf73d57a61117765858ddbda1bb30d50ed73291cd101f101d0c3
SSDEEP 48:KUQILKlCcTytFIxK20ceBIBKaEUTyd9IRKu0MoXsT3tR:KUQQKlCS2FqK20hBmKaEaW9SKu02
TLSH
T1DEC10802307B1A872EBD6F0D9691C71A474175A33018A82B7FE9407A4DAED380DFD9ED
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig~RFe58fdb4.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig~RFe58fdb4.TMP
Size 3KB
SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
MD5 904e6e94a1d46374c8630cfd86cc729f
SHA1 e1d9c3f7813878acc6510d48d95b2bf48b2e1a0d
SHA512 081e2a26252860ff8d8f7a9d0378ae56f0cc50574d13d2a121afdf74284963747ef874a4d73b1df7774cd8570972f4f513eefe0a0325fd088556d5b1ba946712
TLSH
T1DB815C4FCC0CBE77ABAB6A719A35D6B2F79131EA94518A977F8C444EE3050ED0242E50
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 19KB
SHA256 f5c61b31908487a1f81f9d955b2f250665919e2cd116fe7996b5754ce77d1505
MD5 b6ade9db496bda532d7254bfe6a56be7
SHA1 0641e2cda8c0653d52c2bb0e06e366e1202cc05d
SHA512 6afaf93c24b5666923d0681a7cf3031c448d580ec35a9969359fa9f7359c65bd7deedd1f211dc9c6dcd841b8b15f0192eae918ddc5d3a21bf96e903fec4b30fe
SSDEEP 192:uOm+xasuheOwQxMGsNHOQiom8SQmiU1fv34k03HZ/NqLIGqoi0RYRF69J4JgqnDm:WZcIhsNHOFjNok8l3sBeRs9JKgqijUIn
TLSH
T121929D7158786D7AA9F3A681F48637274FB89027E7C46FA4E5EC7B0C01CA688130B817
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 27KB
SHA256 b94f70c64ee1ef2b64f7cf9737ef2fddcb0539a2afdf3ce4a9cb9f70b3a8be73
MD5 eb8e20a33a422a052feb7bbb9844c409
SHA1 8a813f553e3410c9204e86ca97b64dff6aa0086a
SHA512 dab381b81c9d008f1001c0ed271dab7fb40cf269f1706535e24e9711d9f171ad3d69dd14ca5a749abe639a17fc394fe1e652659c45260ab4fde9eb06c5c21b86
SSDEEP 384:yiFiZcIfzsNZ8TUNTUlIlrFjCok8lksBeRs9JKgqijUIn:5FQbgwg2zsTjKgqmUIn
TLSH
T161D21AF144E7553AE9AE9B43E77D2E134EBCC067B5849A94B3D8650CCD861BFC306811
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 20KB
SHA256 986bde857b5d5e09c89fcf7a30394eec6adabfd52c066c0cb3f729dedcfb2bd2
MD5 06d6c74532a53cca4ac85a068f6d5da7
SHA1 5b819d0d7e555be7f27313113dffef607f7d0194
SHA512 dba478482b0e2e68538c6c902b9a4a9b23d1b5408be3264484c9de287b83710fee969a62d7df959c4a9c7a6495a12755d2a5425d4f914402be3ea83fca4f871f
SSDEEP 192:ujm+xasuheOwQxMGsNHrQiom8SQmiU18v34k03HZ/NqLIGqoi0RYRF69J4JgqnDm:rZcIhsNHrFjYok8l3sBeRs9JKgqijUIn
TLSH
T17A929E7158786D7AA9F3E681F48637275FB89027E7C46FA4E5EC7B0C01CA688130B917
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 1821669f0bc2803e5ceb87bbab65d40a0624a97160d4082ac57b55163c20297e
MD5 443b348ca37a4629381ed1095698e5f8
SHA1 100a086d8eca361bc3b984c11aaaff151ae0ecb0
SHA512 7d9f53fe8e0d906fd30aaa9c48e56a8d84626685469fb9605cc799531ef59efc7d6f08d952cc287333d706236426426ebe28fdd259a534a2ec441c47b3abb965
SSDEEP 96:cqONkWQsjpfmUTJK5ih/cIPURHl8h4otop5swDmnB+Pwivh50xy0SFYKsAxXeYzv:HONC6k0QmiUyfcY903HZ/NOcRGqoU6
TLSH
T1E9123A3268B86C7B9DE3A941F08337235EA5912BEBC96F94D5EC271C05DB29C1307813
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 0ee4b51053bd762c6655e3e21d83754c9dc8c8e2ddfa0197d0caa0d53e946a98
MD5 11b446b3eef0857da6bb959a8e44fd5e
SHA1 d3c3433f26fab9e94b000fea7c8d127ad962d1ed
SHA512 24ad9e05647cb0df575f1734887d83ed48ce03f89d51c1b5d2c165fa06046e319a04ee3ae96a36a7cc7a8b96dfbb4cca1d5d0e198f4e16561a8839db8ad0c405
SSDEEP 96:ZqONkTQsjpfmUTmDK5ih/cIPURHl8h4otop5s5DmnBhPwivh50xy0SFYKsAxXeY9:gON/6kDfQmiUyucZ903HLQit0U6
TLSH
T14E02E9356C782CBBDEE3AE49F48677275FA5212BEAC52F84D9E81A1C00D764C1743827
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\metadata.json
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 0194827d4c6e75063ff3d75af0c0c8e9e9486469fb19241cae1091ec0340b36a
MD5 045eab15dab53bf3b96a010970b921b9
SHA1 a22374eb27730d98a77e2022750f81ed04ee89a4
SHA512 cfc03c012f3cc7b5ae12a43b69ab5f554d8b716ea9667479a694553fa3eac8c70ba896ebe2ced9577267357c5b48f797ed5a106819c339d9c4eaf33b9efa7ea0
TLSH
T15641E959AAFE1108B3B77E16AFF6A86D487EB9672E0B845D10110D8F0666B40CC61B33
MD5 SHA1 SHA512 TLSH

Submit Download