719fffd9ab8829c73a78ed50047bb85980904ca69de9a0bf1f84d9cd566b6e0e

Analysis

max time kernel
148s
max time network
157s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
04/08/2026, 18:14

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
sys_buddy-2.3.0/design/project/Sys-Buddy Dashboard.dc.html
Size 62KB
Sample260804-wvcf2abm81
SHA256 719fffd9ab8829c73a78ed50047bb85980904ca69de9a0bf1f84d9cd566b6e0e
MD5 b75328c0ac00c5f3fa7886d23dd200b5
SHA1 5b911f0f2e83a41b3e225ff66e84cdc2bc6e9bd5
SHA512 9cdfa6253ff9d6eff657c336bae26af1137dfabf4b3a6b83fc1569dd62614d6203bec892c408de896196467cd0b452351ce33a9f6bb5c2424d1b03ad37f0074c
SSDEEP 768:MMFr2zRfV/20zItn6c6qjsK0skqxFdEnW7fwATSzZHBLcUzr8wdvvHk5MMIrVagX:MayVs56q3dG/BLcHwdvvHkLNkN4acM
TLSH
T1D453F720E1B2843C6873E157BB09574E3A54E64FC64925C8FB9D21309FCB9B699336EC
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
2988	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134303408666556824"	msedge.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1788976790-1541110888-1636651838-1000\{AD35424F-9ED5-4BB4-8EA5-F2B1BA803143}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2400	msedge.exe
2400	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
2984	msedge.exe
2984	msedge.exe
2984	msedge.exe
2984	msedge.exe
2984	msedge.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
2984	msedge.exe
2984	msedge.exe
2984	msedge.exe
2984	msedge.exe
2984	msedge.exe
2984	msedge.exe
2984	msedge.exe
2984	msedge.exe
2984	msedge.exe
2984	msedge.exe
2984	msedge.exe
2984	msedge.exe
2984	msedge.exe
2984	msedge.exe
2984	msedge.exe
2984	msedge.exe
2984	msedge.exe
2984	msedge.exe
2984	msedge.exe
2984	msedge.exe
2984	msedge.exe
2984	msedge.exe
2984	msedge.exe
2984	msedge.exe
2984	msedge.exe
2984	msedge.exe
2984	msedge.exe
2984	msedge.exe
2984	msedge.exe
2984	msedge.exe
2984	msedge.exe
2984	msedge.exe
2984	msedge.exe
2984	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
2984	msedge.exe
2984	msedge.exe
2984	msedge.exe
2984	msedge.exe
2984	msedge.exe
2984	msedge.exe
2984	msedge.exe
2984	msedge.exe
2984	msedge.exe
2984	msedge.exe
2984	msedge.exe
2984	msedge.exe
2984	msedge.exe
2984	msedge.exe
2984	msedge.exe
2984	msedge.exe
2984	msedge.exe
2984	msedge.exe
2984	msedge.exe
2984	msedge.exe
2984	msedge.exe
2984	msedge.exe
2984	msedge.exe
2984	msedge.exe
2984	msedge.exe
2984	msedge.exe
2984	msedge.exe
2984	msedge.exe
2984	msedge.exe
2984	msedge.exe
2984	msedge.exe
2984	msedge.exe

Suspicious use of WriteProcessMemory 32 IoCs

description	pid	Process	procid_target
PID 2984 wrote to memory of 2804	2984	msedge.exe	87
PID 2984 wrote to memory of 2988	2984	msedge.exe	88
PID 2984 wrote to memory of 2424	2984	msedge.exe	89
PID 2984 wrote to memory of 2424	2984	msedge.exe	89
PID 2984 wrote to memory of 2424	2984	msedge.exe	89
PID 2984 wrote to memory of 3080	2984	msedge.exe	91
PID 2984 wrote to memory of 3080	2984	msedge.exe	91
PID 2984 wrote to memory of 4456	2984	msedge.exe	92
PID 2984 wrote to memory of 3868	2984	msedge.exe	93
PID 2984 wrote to memory of 4456	2984	msedge.exe	92
PID 2984 wrote to memory of 4456	2984	msedge.exe	92
PID 2984 wrote to memory of 3868	2984	msedge.exe	93
PID 2984 wrote to memory of 3868	2984	msedge.exe	93
PID 2984 wrote to memory of 212	2984	msedge.exe	94
PID 2984 wrote to memory of 212	2984	msedge.exe	94
PID 2984 wrote to memory of 212	2984	msedge.exe	94
PID 2984 wrote to memory of 116	2984	msedge.exe	95
PID 2984 wrote to memory of 116	2984	msedge.exe	95
PID 2984 wrote to memory of 116	2984	msedge.exe	95
PID 2984 wrote to memory of 4956	2984	msedge.exe	98
PID 2984 wrote to memory of 4684	2984	msedge.exe	99
PID 2984 wrote to memory of 4956	2984	msedge.exe	98
PID 2984 wrote to memory of 4684	2984	msedge.exe	99
PID 2984 wrote to memory of 3300	2984	msedge.exe	101
PID 2984 wrote to memory of 2748	2984	msedge.exe	106
PID 2984 wrote to memory of 4392	2984	msedge.exe	107
PID 2984 wrote to memory of 1592	2984	msedge.exe	108
PID 2984 wrote to memory of 884	2984	msedge.exe	116
PID 2984 wrote to memory of 884	2984	msedge.exe	116
PID 2984 wrote to memory of 4992	2984	msedge.exe	117
PID 2984 wrote to memory of 4992	2984	msedge.exe	117
PID 2984 wrote to memory of 2400	2984	msedge.exe	119

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument C:\Users\Admin\AppData\Local\Temp\sys_buddy-2.3.0\design\project\Sys-Buddy Dashboard.dc.html
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2984
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x25c,0x7fff2847c188,0x7fff2847c194,0x7fff2847c1a0
  2⤵
  PID:2804
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2000,i,12516373741382187476,12738711750550894982,524288 --field-trial-handle=2288,i,779558192868403631,15299353794329085109,262144 --variations-seed-version --mojo-platform-channel-handle=2324 /prefetch:3
  2⤵
  - System Time Discovery
  PID:2988
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1884,i,12568224463976023055,3964086727037345284,262144 --field-trial-handle=2288,i,779558192868403631,15299353794329085109,262144 --variations-seed-version --mojo-platform-channel-handle=2284 /prefetch:2
  2⤵
  PID:2424
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2600,i,17089678587650185538,14467296840160767815,524288 --field-trial-handle=2288,i,779558192868403631,15299353794329085109,262144 --variations-seed-version --mojo-platform-channel-handle=2748 /prefetch:8
  2⤵
  PID:3080
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3424,i,13465011318706750561,10080465167176737221,2097152 --field-trial-handle=2288,i,779558192868403631,15299353794329085109,262144 --variations-seed-version --mojo-platform-channel-handle=3460 /prefetch:1
  2⤵
  PID:4456
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3436,i,11486356479355468643,17680358606904269785,2097152 --field-trial-handle=2288,i,779558192868403631,15299353794329085109,262144 --variations-seed-version --mojo-platform-channel-handle=3472 /prefetch:1
  2⤵
  PID:3868
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4192,i,2942491165351670637,5867851905983295558,2097152 --field-trial-handle=2288,i,779558192868403631,15299353794329085109,262144 --variations-seed-version --mojo-platform-channel-handle=4236 /prefetch:1
  2⤵
  PID:212
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4204,i,14647302591377139541,10826009595491239347,2097152 --field-trial-handle=2288,i,779558192868403631,15299353794329085109,262144 --variations-seed-version --mojo-platform-channel-handle=4332 /prefetch:2
  2⤵
  PID:116
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5124,i,9533866921281885045,3805588868878425193,524288 --field-trial-handle=2288,i,779558192868403631,15299353794329085109,262144 --variations-seed-version --mojo-platform-channel-handle=5176 /prefetch:8
  2⤵
  PID:4956
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5016,i,12660206947548755494,2572660674539351840,524288 --field-trial-handle=2288,i,779558192868403631,15299353794329085109,262144 --variations-seed-version --mojo-platform-channel-handle=5164 /prefetch:8
  2⤵
  PID:4684
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5860,i,14132600403349247972,16234688012261004610,524288 --field-trial-handle=2288,i,779558192868403631,15299353794329085109,262144 --variations-seed-version --mojo-platform-channel-handle=5876 /prefetch:8
  2⤵
  PID:1656
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5860,i,14132600403349247972,16234688012261004610,524288 --field-trial-handle=2288,i,779558192868403631,15299353794329085109,262144 --variations-seed-version --mojo-platform-channel-handle=5876 /prefetch:8
  2⤵
  PID:3300
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4360,i,2180520375678646568,4419154412742737254,524288 --field-trial-handle=2288,i,779558192868403631,15299353794329085109,262144 --variations-seed-version --mojo-platform-channel-handle=4464 /prefetch:8
  2⤵
  PID:2748
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1880,i,9891328474517081364,6049039604694443313,524288 --field-trial-handle=2288,i,779558192868403631,15299353794329085109,262144 --variations-seed-version --mojo-platform-channel-handle=4552 /prefetch:8
  2⤵
  PID:4392
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3572,i,13655582654804259744,15461553732113136024,524288 --field-trial-handle=2288,i,779558192868403631,15299353794329085109,262144 --variations-seed-version --mojo-platform-channel-handle=5916 /prefetch:8
  2⤵
  PID:1592
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5188,i,5549447034037100682,1987790490579701870,524288 --field-trial-handle=2288,i,779558192868403631,15299353794329085109,262144 --variations-seed-version --mojo-platform-channel-handle=4456 /prefetch:8
  2⤵
  PID:884
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5812,i,5968614021309930775,5955570667924885219,524288 --field-trial-handle=2288,i,779558192868403631,15299353794329085109,262144 --variations-seed-version --mojo-platform-channel-handle=5664 /prefetch:8
  2⤵
  PID:4992
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=5684,i,6453273454599169755,1847525787858679075,262144 --field-trial-handle=2288,i,779558192868403631,15299353794329085109,262144 --variations-seed-version --mojo-platform-channel-handle=2044 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2400

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:812

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

blocklist

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\blocklist
Size 105KB
SHA256 19770e7fe2094711e80964a836e60964de6a8ad16ccaac3d8dfad98369019638
MD5 44dad74e010b183434bee387e897e5a5
SHA1 1e8cd1a25c1805f95db825d1abc631a4dc4b3528
SHA512 4bbc70e7b7329e93d20b196e728888ea0151b121d95738e26f908478d84bd38ac8410bda7f62d907ab7d1206a6ca2df9c6c71f59ce1ad6ea772dbae5c26236d5
SSDEEP 1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P73:fwUQC5VwBIiElEd2K57P73
TLSH
T1CEB3B931457E36BF26E93EE828CF1511B84F3912664895D4ABE1FE2C4845E68633CEF4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 6d0f88884e23b1418c456620b79662feebdfd970ca9325ba2981c94b3b0f0b2f
MD5 7060eae8ec426d15de2849b1f7d261b4
SHA1 b252d90b9d7050d0b9b7c03141d9d3b7cae404ac
SHA512 8791005fae20dc1dc5dc5b0086efe814e0b1e36781ef1931cc1fc699fc4cb34d62ab3f9a83f4967824f3bb71aef6adc6ad457ab7a6addcba99f9e9b473eabb4d
TLSH
T118D01222BE08A415E65BA271A502C7141F5954A124938651E224D86CD9F84D49696387
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 4d517b88a0fb88494276c126764235de9ee52961c86cc4d3abaf517b10a649a8
MD5 dde9ea8dd9c7e315ef614ab3476af02c
SHA1 e03e201e89770d15b4040d579c2cce8684959a2c
SHA512 410e016336529d709de957d44e67238e4f6592b9ce6646395a9e45ce592e7810b4cb6b1b6df5d8b26875a6aa235b77d41c0983ccc055556f8b8c02224093fdd1
TLSH
T16DD012227E08A415E65BA271A502C7141F5954A124938651E224D86CC9F94D49696387
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 82a6c5bfff68f422c6b408330011c7a14f4deae2129a0c70c5dba7ab07a3e4b6
MD5 dca00440645e3855c8c480bc27fc9370
SHA1 ce91bfa627a7bbd1ac9728d2389e1aea6d7f5fa9
SHA512 fd8d286f7b91648dfdf8257c21d1e25f59616c2335be7faa1dbcf5f880c89b99fc7257128b3b488ad47a3819cc2f679f58aef833ebe6715b38e79f52ae4a2b28
TLSH
T1257129B620010193EF210F70909372F27DFCB6E8F2579EF92D7089BB65063A086AD90D
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe58b6c8.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe58b6c8.TMP
Size 3KB
SHA256 2c531500054d517f537a75ef7c2d77fedf43b0a1f12e715eac9f2a9b15ee7f80
MD5 407a1f3d25b72303b3775e5aac108622
SHA1 0e9bf9452ab22e6df971c0489d90246356b84280
SHA512 4fc4086150dcfbc393486b62c8ebf23f10c7b6a0ace454b0afcdd35993ef3f6aaed5d3802998b4dafca7a0281a36c137ebfd962529da0e09c6260f315496b3ef
TLSH
T185712AB620010153EF210F70909372F27DFCB6E9F2579EF92D7089B7650636086AD90C
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 1KB
SHA256 a3e561107352c582b2410b98e20cef7b86de180d8438fe8c444b0c7da620bcee
MD5 a0d9758fbc65e75a81e4792f61f200a5
SHA1 0def4690038e7054acdd92181b82dae054f7ddc6
SHA512 b3142b502cf1a4649a6e33017fc51fbe504496eabdcddee6a997e862dfddea47ef2c12572b61649479883fca9381f491f620779ee858134897d662f549b9cc6f
TLSH
T1A1418FB6C3D5866E891116F05B28BD37DE1D061A42287C2A89F4FF5BA3E2472E10169F
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 8c0df923ed65ee246fa2bbedf8da5bff306ce0656a81b27fb74101f0e4a4eb3a
MD5 fa4e93c129e62b5aec9d8b88b3625545
SHA1 5e15160384a596934bc1cb0c4cc4e34da2e5d92a
SHA512 fda6df3429e7057c405bae4712546832de7b97fe2f6b731751c2880cfb1da44600c37c77960c7c70ac5f70fc2ea596f2edf23001a8f7ac9dcc8841ccbdfdbb0b
SSDEEP 192:sxZtRhyM/jK1Ml8MkN/fLsEGMLVfIdpdPHW6+WNGYvrbd/mYIgrJ:sxZtHMN/fLs3MyZHbGgO09
TLSH
T11242F8116A346977CCCBD20DFA51BF93D6F9157292901E44A9FCDA1C04E6BEC221781F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 cfc88522ee9eb0f7e4b73e660b75ed3dcb7bde2216f561b6d28f2d1a09583dad
MD5 764af68d68dc56f08273b95fd981b6ea
SHA1 cc54a47f456a566303275410c985ab45bf04a04f
SHA512 7e839e6be205f7521dfa6279127aa81f5827b9b4c674180e6d37b06196708591b60bf6cc3297143d5ba382eefbb305c56645341a45685fc6dce2e00ca1e82501
SSDEEP 192:sxZtRhyM/jK1Ml8UQ0kN/fLsdGKLVfIdpHPHW6+WNGYvemu/mYIg5/J:sxZtHqPN/fLswKyvHbGHO0n
TLSH
T1CF5208116A386977CCCBD20DFA51BF93D6F9147292901E44A9FCDA1C05E6BEC221782F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 30KB
SHA256 a451a99c506d827c9299a6b9c44914533276eb3337aca1ae511edc01e2dd738b
MD5 bf008b1ad09d886fff6499e1625b7831
SHA1 02b37d70cfd18a7ca4ccb718bde85173efd03f95
SHA512 58cfb1a109fdac43cc9e7d0ac16d5102d53851953b48afa8aa66933f4bb0f98a4810a3e1db3f43fb2a21b717051f14617221670f47cae6d25714fb8b0f6808e4
SSDEEP 768:2YseJ3xWvhfyn8F1+UoAYDCx9Tuqh0VfUC9xbog/OVYcLly0pplroc4:2YseJ3xWvhfynu1jaVcL88pef
TLSH
T11DD20B2B280CCB7E4F844E6DEC266F966EE801CB57984D5487EA884C03C77EB51275DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 1fd08348beda89ff9ba1fc493b1e39610fbe65bcd9a8fca1dcd89324f44574f5
MD5 6d2aedc8a8de3d0a59d7eec3e1c89c7e
SHA1 fa9cb9c873cbaddb27eb8646e4acc2e2e4b6af54
SHA512 28959885ffbb99d929283b30e6f712acf3a3b3295242849a461fdefce2520cd2db5f3eb336475ecb12e1b12f8062281549b8bce5f4dc3103cc70cf2094937ea7
SSDEEP 48:KYHIhKggkXy8+FCuEA8kMADPIDmkKqBickWO0VjEO5y083ocGO+2kOh9ILc2KWT0:KYH+Kggmu32KYAe+ReKSohz
TLSH
T1D2915917357B02023CBD6B4CA697A6378E4172973814A46F7BB904A20E27E261DFD8DD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig~RFe5950e5.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig~RFe5950e5.TMP
Size 3KB
SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
MD5 904e6e94a1d46374c8630cfd86cc729f
SHA1 e1d9c3f7813878acc6510d48d95b2bf48b2e1a0d
SHA512 081e2a26252860ff8d8f7a9d0378ae56f0cc50574d13d2a121afdf74284963747ef874a4d73b1df7774cd8570972f4f513eefe0a0325fd088556d5b1ba946712
TLSH
T1DB815C4FCC0CBE77ABAB6A719A35D6B2F79131EA94518A977F8C444EE3050ED0242E50
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 11KB
SHA256 c29c0b55f21f515b7d2815a0ead3a3d4e1113879911eb931169d4dc5db751df4
MD5 238391b7776cd13cd44871e0573cecb8
SHA1 5eb4c247efedbd26bfd9845fea9bc6ddf3634f01
SHA512 c98c83ba5ab72558c88774c6c5487d2311b66c85c070e2a570e3f397dcfea4e21bd6368313f837d78a4a61dd7a3c6aa0d67fb752aac4deaf4709997634ee0315
SSDEEP 192:uwLsN/NQlfpI+M7upyQmiU1BhZB4MT/hCi0bcvNZ8z1Q9qeUMZ:jsN/N0Rm7CutZu9dc+QHUMZ
TLSH
T10C422B72AC689C2B9EA3A191F08A36035FF5916B9A846F54E6DC2F1C01DF35C130791B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 64d6f2b5f7c2539e57a100ee2a4d28d56df3ad976a1948c6ed956c4391ac9111
MD5 0bd640ebc244594f54b211ed4ec2cb20
SHA1 948aa4755ca248a0672816874eb8d04930e44d70
SHA512 2b3394a3dff5701234f294a6814b3ea5bb47c35cf84d837b1c210ed1eaabc768ea5737bd617b46503b94fdf189f5be701b150c7123634c7cace813a44d69710b
SSDEEP 384:UkiFiZcISzsNh8TUNTUlIle0Rm7CutZu9dc0QHwz:U/FQ6AwgdmLOdNQHwz
TLSH
T17F824C739C54C93FEEB7A681F58932038EF55167C5C5AA90F6DC6E1D01DB198030BD16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 33af9b9ffeb5e1233651955eb44e38584526f66b50b7c7ef239029a4558d6aa1
MD5 af2a4481c0b3ff971183b052d0d4e2f7
SHA1 4553ea3da92f527033e35475474dcd32b843166d
SHA512 a5b363f8d729cd74a3323ddf985c8e870c8996957c41760b1ee26aa3415d7cadf9ba692370bf122d5c7f5f0c88a2ab2cfc60792d849dc3a6cb88d7cb71833b57
SSDEEP 192:lONV6vMtPQmiUy4ZThT/hCi0bC847Qj1U/u:lONV6UtRdTSdMQhU/u
TLSH
T19E022A36BC686C6BEEA3AE45F48A27171FE4217FA5905B50EAE82F1C00D724C1303937
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 15KB
SHA256 74715d3b6765a5d896d7796dfa7687de2a7efe58ee91520de2ca58897819b60b
MD5 07079d7de0c10f63253e023a5c9e2470
SHA1 4444c49cf39d79fee24be7754a50bbdb6fe4af97
SHA512 38e4ea94a60749b1b17bbf608418bd78b16032a7eca8caae30d9e6806802ffbec555c704b8c0205c32d999626b30ef2ab58db735efa1a2190dc3216a747518d7
SSDEEP 192:ujam+xasuheOwQxMGsN/eQlfpI+M7upyQmiU1BhZB4MT/hCi0bcvNZ8z1Q9qewxN:MZZcIhsN/e0Rm7CutZu9dc+QHwz
TLSH
T1C6627CB3AC789D3BA9A7F281F58936034FF4912796C45B90E5EC7F1D01DA268030B91B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 9KB
SHA256 559ad304d947a6d148909905466b758cdd039bda555e1f93c9da768dd45c2bb2
MD5 48068d042acfeeb6fcb4e5efba95e813
SHA1 4e95ad26f0ba15a70ac679a684186ce2bb281902
SHA512 04a98a364fe2c67cf8100b0af2292506a27b9c7f7665ac31b1832ac7b29046858ffed6cdb14aa3662fcdae03d10945dacfc1c78d04172f5e2cfbdc8399baa18a
SSDEEP 192:JONi6vMPPQmiUywZEhT/hCi0bcvNc80IQ9qeU/u:JONi6UPRVESdchQHU/u
TLSH
T19F122B72BC689C6F9E93A581F48A22075EB1926BDA856F50FADC3F1C01DF25C1307927
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VariationsRuntimeSeedV1

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\VariationsRuntimeSeedV1
Size 484B
SHA256 9fd2b7fae87c2d863b486a425834283f19b1444749c84650d5a48c9eadb12e2b
MD5 e9289cc1f579fdfa9d46acfae9b38330
SHA1 7eac8e241d8c35d873280d6b9dbc1cca7a9b2231
SHA512 b1f37da50e387c8408a960ef5276a51336510286c1db7eaea4cde65af4efc343f8ac1d9de65df1fd0818513823a485733e5c155da615344bc044f46021ecf586
TLSH
T134F0543C33D821A4F08C46B23596ED8B88BF313247DC2631CA50F550315387701B5095
MD5 SHA1 SHA512 TLSH

Submit Download

VariationsSeedV1

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\VariationsSeedV1
Size 2KB
SHA256 c247db60c01396391f373d871afccfe0e1fc2ee96acf6d1e011516c9628629ae
MD5 8547fd8fa0bbdebc88a5f42ab00282e6
SHA1 eb0b7700d528bc7ef5193c86f8a35829051dd993
SHA512 13cf2fab1faeb31466d6786a69091ad2e0dd7db04dc7efb5793a9a0c577491233f8de3b230c4d40efbeac5e86cfbe8296d605b12221f8df8ed6cdaa2b453a66f
TLSH
T1CF513A450AE122BB6BA7BBF04E4195CDA33B3A0FE2E984CF54D048B565738A355944E8
MD5 SHA1 SHA512 TLSH

Submit Download

b9d5c10d-5b57-43c8-a3c1-e8599ceab04e.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\b9d5c10d-5b57-43c8-a3c1-e8599ceab04e.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 7ca4fbbc4210b13c5d37e0a02f8e165d67f752ef95b3c48a3c69df4f71add384
MD5 5228c172cde157fe0f1dd46d2f9c6bf5
SHA1 6d64720c7cdc383ff4f126439664f275d33fc7d6
SHA512 b3d2252a3134c7c88af47651715358de150cccfcb401bd121e5ee9e46fdf63aafe74c4b3da41f519a091dcb3b4586fea6b47ee5fbe7b6d3fc46ae105c855b966
TLSH
T104412A5CA6FA1148B3B7BE599BF7A86D487FB8772E46D49D10110D4E0A62E40C871B33
MD5 SHA1 SHA512 TLSH

Submit Download