hxxps://VIAS3D[.]COM

Analysis

user interaction
yes
max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
07/08/2026, 23:11

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://VIAS3D.COM
Sample260807-26rb8aad75

Score

6^/10

discovery phishing

Malware Config

Signatures

Legitimate website abused for phishing 1 TTPs 4 IoCs

phishing

Phishing

T1566

flow	ioc
77	forms.zohopublic.com
78	forms.zohopublic.com
81	forms.zohopublic.com
93	forms.zohopublic.com

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
860	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134306179353373681"	msedge.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1074038928-2032447174-945360078-1000\{F3A141A6-93FF-4A6D-AA18-E7A5A3CD063E}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4880	msedge.exe
4880	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
4560	msedge.exe
4560	msedge.exe
4560	msedge.exe
4560	msedge.exe
4560	msedge.exe
4560	msedge.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
4560	msedge.exe
4560	msedge.exe
4560	msedge.exe
4560	msedge.exe
4560	msedge.exe
4560	msedge.exe
4560	msedge.exe
4560	msedge.exe
4560	msedge.exe
4560	msedge.exe
4560	msedge.exe
4560	msedge.exe
4560	msedge.exe
4560	msedge.exe
4560	msedge.exe
4560	msedge.exe
4560	msedge.exe
4560	msedge.exe
4560	msedge.exe
4560	msedge.exe
4560	msedge.exe
4560	msedge.exe
4560	msedge.exe
4560	msedge.exe
4560	msedge.exe
4560	msedge.exe
4560	msedge.exe
4560	msedge.exe
4560	msedge.exe
4560	msedge.exe
4560	msedge.exe
4560	msedge.exe
4560	msedge.exe
4560	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
4560	msedge.exe
4560	msedge.exe
4560	msedge.exe
4560	msedge.exe
4560	msedge.exe
4560	msedge.exe
4560	msedge.exe
4560	msedge.exe
4560	msedge.exe
4560	msedge.exe
4560	msedge.exe
4560	msedge.exe
4560	msedge.exe
4560	msedge.exe
4560	msedge.exe
4560	msedge.exe
4560	msedge.exe
4560	msedge.exe
4560	msedge.exe
4560	msedge.exe
4560	msedge.exe
4560	msedge.exe
4560	msedge.exe
4560	msedge.exe
4560	msedge.exe
4560	msedge.exe
4560	msedge.exe
4560	msedge.exe
4560	msedge.exe
4560	msedge.exe
4560	msedge.exe
4560	msedge.exe

Suspicious use of WriteProcessMemory 35 IoCs

description	pid	Process	procid_target
PID 4560 wrote to memory of 2768	4560	msedge.exe	85
PID 4560 wrote to memory of 3768	4560	msedge.exe	86
PID 4560 wrote to memory of 860	4560	msedge.exe	87
PID 4560 wrote to memory of 3768	4560	msedge.exe	86
PID 4560 wrote to memory of 3768	4560	msedge.exe	86
PID 4560 wrote to memory of 1884	4560	msedge.exe	89
PID 4560 wrote to memory of 1884	4560	msedge.exe	89
PID 4560 wrote to memory of 3836	4560	msedge.exe	90
PID 4560 wrote to memory of 3988	4560	msedge.exe	91
PID 4560 wrote to memory of 3836	4560	msedge.exe	90
PID 4560 wrote to memory of 3836	4560	msedge.exe	90
PID 4560 wrote to memory of 3988	4560	msedge.exe	91
PID 4560 wrote to memory of 3988	4560	msedge.exe	91
PID 4560 wrote to memory of 3976	4560	msedge.exe	92
PID 4560 wrote to memory of 3976	4560	msedge.exe	92
PID 4560 wrote to memory of 3976	4560	msedge.exe	92
PID 4560 wrote to memory of 2424	4560	msedge.exe	93
PID 4560 wrote to memory of 2424	4560	msedge.exe	93
PID 4560 wrote to memory of 2424	4560	msedge.exe	93
PID 4560 wrote to memory of 1776	4560	msedge.exe	97
PID 4560 wrote to memory of 2104	4560	msedge.exe	98
PID 4560 wrote to memory of 1776	4560	msedge.exe	97
PID 4560 wrote to memory of 2104	4560	msedge.exe	98
PID 4560 wrote to memory of 4648	4560	msedge.exe	99
PID 4560 wrote to memory of 4648	4560	msedge.exe	99
PID 4560 wrote to memory of 4648	4560	msedge.exe	99
PID 4560 wrote to memory of 3216	4560	msedge.exe	100
PID 4560 wrote to memory of 3216	4560	msedge.exe	100
PID 4560 wrote to memory of 1120	4560	msedge.exe	103
PID 4560 wrote to memory of 6036	4560	msedge.exe	117
PID 4560 wrote to memory of 6044	4560	msedge.exe	118
PID 4560 wrote to memory of 6052	4560	msedge.exe	119
PID 4560 wrote to memory of 716	4560	msedge.exe	122
PID 4560 wrote to memory of 716	4560	msedge.exe	122
PID 4560 wrote to memory of 4880	4560	msedge.exe	127

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://VIAS3D.COM
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4560
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x2ac,0x7ffeca6ac188,0x7ffeca6ac194,0x7ffeca6ac1a0
  2⤵
  PID:2768
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1620,i,6666996763242166013,3715319213028813696,262144 --field-trial-handle=2236,i,2696989157657265041,11503640239917277197,262144 --variations-seed-version --mojo-platform-channel-handle=2232 /prefetch:2
  2⤵
  PID:3768
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1816,i,10853022355404376023,14123707457166280422,524288 --field-trial-handle=2236,i,2696989157657265041,11503640239917277197,262144 --variations-seed-version --mojo-platform-channel-handle=2272 /prefetch:3
  2⤵
  - System Time Discovery
  PID:860
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2412,i,9097555319634056578,4693013815896446196,524288 --field-trial-handle=2236,i,2696989157657265041,11503640239917277197,262144 --variations-seed-version --mojo-platform-channel-handle=2404 /prefetch:8
  2⤵
  PID:1884
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3420,i,1116584818693299635,12023248078750821863,2097152 --field-trial-handle=2236,i,2696989157657265041,11503640239917277197,262144 --variations-seed-version --mojo-platform-channel-handle=3476 /prefetch:1
  2⤵
  PID:3836
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3424,i,8630076038578143479,5958111777299630653,2097152 --field-trial-handle=2236,i,2696989157657265041,11503640239917277197,262144 --variations-seed-version --mojo-platform-channel-handle=3496 /prefetch:1
  2⤵
  PID:3988
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4184,i,13820083206887443673,13461260648319997656,2097152 --field-trial-handle=2236,i,2696989157657265041,11503640239917277197,262144 --variations-seed-version --mojo-platform-channel-handle=4216 /prefetch:1
  2⤵
  PID:3976
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4196,i,12532926356674404644,4050367803587800768,2097152 --field-trial-handle=2236,i,2696989157657265041,11503640239917277197,262144 --variations-seed-version --mojo-platform-channel-handle=4220 /prefetch:2
  2⤵
  PID:2424
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5092,i,2053520581633877195,1007907941609157313,524288 --field-trial-handle=2236,i,2696989157657265041,11503640239917277197,262144 --variations-seed-version --mojo-platform-channel-handle=5132 /prefetch:8
  2⤵
  PID:1776
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5072,i,5250491300646660253,8793832677923222274,524288 --field-trial-handle=2236,i,2696989157657265041,11503640239917277197,262144 --variations-seed-version --mojo-platform-channel-handle=5152 /prefetch:8
  2⤵
  PID:2104
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --always-read-main-dll --metrics-shmem-handle=5524,i,17932232220206348163,3253165278875708278,2097152 --field-trial-handle=2236,i,2696989157657265041,11503640239917277197,262144 --variations-seed-version --mojo-platform-channel-handle=5484 /prefetch:1
  2⤵
  PID:4648
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5676,i,17156906938927757395,11610185994681271001,524288 --field-trial-handle=2236,i,2696989157657265041,11503640239917277197,262144 --variations-seed-version --mojo-platform-channel-handle=5680 /prefetch:8
  2⤵
  PID:3216
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6208,i,3933731007109951189,4539067126346771938,524288 --field-trial-handle=2236,i,2696989157657265041,11503640239917277197,262144 --variations-seed-version --mojo-platform-channel-handle=6224 /prefetch:8
  2⤵
  PID:1424
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6208,i,3933731007109951189,4539067126346771938,524288 --field-trial-handle=2236,i,2696989157657265041,11503640239917277197,262144 --variations-seed-version --mojo-platform-channel-handle=6224 /prefetch:8
  2⤵
  PID:1120
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6548,i,761304508464367750,13332504062349617167,524288 --field-trial-handle=2236,i,2696989157657265041,11503640239917277197,262144 --variations-seed-version --mojo-platform-channel-handle=6512 /prefetch:8
  2⤵
  PID:6036
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6608,i,13120390831690616542,5861510385390567371,524288 --field-trial-handle=2236,i,2696989157657265041,11503640239917277197,262144 --variations-seed-version --mojo-platform-channel-handle=6576 /prefetch:8
  2⤵
  PID:6044
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6540,i,10191203491998178358,4426143614244796665,524288 --field-trial-handle=2236,i,2696989157657265041,11503640239917277197,262144 --variations-seed-version --mojo-platform-channel-handle=6652 /prefetch:8
  2⤵
  PID:6052
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5388,i,16820034971846909983,4839148758028711596,524288 --field-trial-handle=2236,i,2696989157657265041,11503640239917277197,262144 --variations-seed-version --mojo-platform-channel-handle=5180 /prefetch:8
  2⤵
  PID:716
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6556,i,9618948756878506798,174917455355068385,262144 --field-trial-handle=2236,i,2696989157657265041,11503640239917277197,262144 --variations-seed-version --mojo-platform-channel-handle=6588 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4880

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:3308

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Phishing

T1566

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

blocklist

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\blocklist
Size 105KB
SHA256 987a8409b500944c2e91e6f0b356beba7853fbf9bc34127cdcac87e36a5d159b
MD5 711b7276ab4cac5c7d0662623628b4f1
SHA1 c0b08a2ce958cd6b3cf43b1b606bddac6f416c76
SHA512 53334798f71067d33c5ea1fc8c14893238cf2be2d4562c934fc37a0753148ec6d84178d601e10f62955b9a3059a4dc075f4e1a5620c5a7ef13184470d069a6e8
SSDEEP 1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P76:fwUQC5VwBIiElEd2K57P76
TLSH
T188B3B931457E36BF26E93EE828CF1511B84F3912624895D4ABE1FE2C4845E68633CEF4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 85da5d101c008762046da9670ca95944217bbb1829e60a748f367ee4f9926b13
MD5 ef105d8d3e87a813544857290c28833d
SHA1 bfe7010cf80fb8cbcb9eeb5e0d0b551ece0b3134
SHA512 ae71c302652e2de890fca25723381f403f4f9ee51e2da6583977318de3e7ff00defb73b202e17a287def3ff618de86c0af96c0fca7729ef3efe0a4ba3cfdfc63
TLSH
T16FD0803377C9A100F6567375F413C7412F27057415868613A168C45CDC784C557C92C7
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 98eae6fcc56d922689f3a45ab65635857e6510c437555d4eae3a6cd68dff3acb
MD5 338a3c92e96cad1510815c958fc76de7
SHA1 e1234ace09aad728f9bde0798e2fb22ee82583de
SHA512 e29c9087bb4c9c94c8525a95c307117f14827336de29aa01f837bd02b05b3aecd1c1771970519a60972a1495e05b4f68ab34cf5e4ec9d7060f6383ac019c2ed7
TLSH
T17DD0803337C9A500F6567375F412C7412F2705741586C713A168C45CDC794C557C92C7
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 5KB
SHA256 3f3b29d09826a98cc83f781c6b3230cc9821fa58e079d76b095a017e91470c99
MD5 3849a974afb914c75e295a557f236997
SHA1 38a5e9502c331c1e7724faee0527f0feb9605ce9
SHA512 36d72d69b1b0f9e96be48c7dee3643db54a9b7212e3250240c8bc19044e815e32dacf1aad7c2f20d0a13e5fbcb77dcdd09665dddf40a2f3da099ba1ba8271fde
SSDEEP 96:4XTtVDfjVO5pWGwK25xiWyhlpaBMJqRRxOwk:6tVD7VCpWP8T/P0RxTk
TLSH
T1B8B1C92207D82926EB5B3731F29A6D1AF0B48157BD3B2BB31108DD3C36577D0961942F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index~RFe58d433.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe58d433.TMP
Size 3KB
SHA256 907caf43025dda61cdd69816783cb52a06725097afb8c3b5554e955b78252aed
MD5 94f73207020c31070014cf5d65a09ca4
SHA1 cb902bfc9471ff42ee14e0e5000f046ebb5e2999
SHA512 ec3e9dffbef24aab56b800849aa3f1db8ad3b65467f4fd9f99a9b61ba4d8e9b04edb444ba22d776fc68a109eae9fbe6ff0a517bce17001fff7f56bb13a0e81e0
TLSH
T10D6141271B4D0963E3693372E0EB3A16F0B1D64BBD774D721548DA7D660ABE1C21D80C
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 aa10bf07b0d265bed28f2a475f3564d8ddb5e4d4ffee0ab6f3a0cc564907b631
MD5 807419ca9a4734feaf8d8563a003b048
SHA1 a723c7d60a65886ffa068711f1e900ccc85922a6
SHA512 f10d496ae75db5ba412bd9f17bf0c7da7632db92a3fabf7f24071e40f5759c6a875ad8f3a72bad149da58b3da3b816077df125d0d9f3544adba68c66353d206c
TLSH
T18DB01269E5507CFF074A83A41428B463C3FF0047421C8ABEEA3873AD42A21FE0828C57
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 10KB
SHA256 ec96d946e1e51a61b189a74c4d3fe0b14505cd938146fa6c3dc2e540d06f5617
MD5 42f2041fe40010a1cca8927f10152b70
SHA1 cfbfe1de11055b9e89a38d13a8db6311496595e0
SHA512 8a2f4ead70013ddc1c65a27db8ed6676b77a849cffa4047dbf48e46dee9103c6b7c17b5c5d3c6a52e4e87025361b495895e63dd26d4ad693785fad4c3497ac77
SSDEEP 192:D33w0ZceneFw1JvSceLYB2p1mtVzb0pi6AzJNM/NS1IR0/g+5OpF6UVVdEgXbEv7:D33w0ZceneFw1JvSceLYB2p1mtVzb0p+
TLSH
T1A822A7A783E5C63D991216F49A14BD1BCE7806244B2C3D39C9D4BE9BA3E2031E24275F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 8fcec2952b7b0d8f2b9f55fe3efa874c386ca4329ebd5507a957d617817c7119
MD5 96e5294136b1df24895def64b1924167
SHA1 189c4a1dbd8c06d1e0a2b97f85f335da1b43b0e0
SHA512 af5606a4c989f9fa454d847eb6a532eda03e392d4e3198406e1719e643b5661ea0707897fe3a6e656a6ec442b25d652335a143663e957cded817daf80f518c2b
SSDEEP 192:sxZZRkyM/jK1Ml8Mkt/fisS47EdpqwHW6+WNpvk/Y4TxJ+ZIgrJ:sxZZWMt/fisS44LHbu/hy9
TLSH
T14542F9126A346977CCDBD20DF941BF53D6F9156292900E84AAFCDA1C04E7BED221381F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 222b7c8a35ea8de83c3684648be2c2262a018f95505b4b501eff0f2fa1c3a6e3
MD5 b51de843b47bbb117a0a050a6a9f37d3
SHA1 080506d39f221c34b25022b9ff8f218678833498
SHA512 48032dc12a975ab6a5a005371055b720f70846671b4a68876110d5afe0e51b26d9fac181614bec77542eb2fc9db0958c014d2021e98f1e24eb3084641bf3292c
SSDEEP 192:sxZZRkyM/jK1Ml8UQgkt/fisteW7IdpkwHW6+WNp/LdY4COJ+ZIg5fJ:sxZZOqzt/fisteWkRHbZdbyb
TLSH
T17652D7116A346977CCDBD20DF941BF53D6F9656292900E84AAFCDA1C04E7BED221382F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 85b13331ea093642431e39e7ec2515c9ad9093e66dca4bef78a6e30aba377df4
MD5 6add3b410c59a8dad8bf4c31a7cd7992
SHA1 9052f436689ad85397ae9a3dc3f674cb067862ce
SHA512 9ce003321044c1ae88693b9aafbda28cfcf72af3065a12a70f0a8d798fbb2ebd42b8ed7c7249696891f4bb53e48c5447985fb29989ff5de5a7d89ac98df41456
SSDEEP 192:sxZZRkyM/jK1Ml8Mkt/fisteW7IdpqwHW6+WNpXs9Y4G5J+ZIg5fJ:sxZZOMt/fisteWkLHbu9wyb
TLSH
T12B52E7116A346977CCDBD209FA41BF53D6F5556292900E84AAFCDA1C04E7BED221381F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 30KB
SHA256 b0649b8a1b2a7ce2191539135dff9765d7c930b35f1e77115bf93aa24f9cce36
MD5 c02e4a96d4036f8804e75cd6b7edb3de
SHA1 7fc31000f99710a620012747ac1dd0065a3524cb
SHA512 19eac6864d3e9f82bcc9dd73b2727be7ef4a17ce3898373ba04574cc2c4cc594222d48196d2d30a5786c829d552d2e6c312b4d41a1c0dae363f06a95ead22472
SSDEEP 768:wq8iJPNWvx76r8F1+UoAYDCx9Tuqh0VfUC9xbog/OVsALl6opdnroEk6UnL:wq8iJPNWvx76ru1jahALocd0qUL
TLSH
T124D20A3B680CCB7E4F844E9CEC266F966DD801CB5B944D5447FA884C03CB6EA51279DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 5KB
SHA256 104a0cdf92a6362bfeb049961636af28b3fb4bed9a14a2aeb16c5ef47bf8e054
MD5 dc84c2dd2fddef109284de29697ae525
SHA1 7fdceb4a750fbf54243ed06076fbb3311d1b2e74
SHA512 48ec49825010775570f98e856de7a325c4e74670adf8d0126046041e26880d5ed0f4276cb38cdb6a92db03b25a87a3fa8f50e6131ae866ae8b0dfd809fb43816
SSDEEP 48:KATIxKAwUzy9DI1KcMQAOIvKTywDyhKI/K/akN:KAT6KAwieDqKcMbOsKTy+SKYK/ae
TLSH
T1A8B1401172BF12023C7E290C92958E26464270633624A43F7FBD04B65E66E794EFECDD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig~RFe590b51.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig~RFe590b51.TMP
Size 3KB
SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
MD5 904e6e94a1d46374c8630cfd86cc729f
SHA1 e1d9c3f7813878acc6510d48d95b2bf48b2e1a0d
SHA512 081e2a26252860ff8d8f7a9d0378ae56f0cc50574d13d2a121afdf74284963747ef874a4d73b1df7774cd8570972f4f513eefe0a0325fd088556d5b1ba946712
TLSH
T1DB815C4FCC0CBE77ABAB6A719A35D6B2F79131EA94518A977F8C444EE3050ED0242E50
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 19KB
SHA256 0e4febfe81ef38459930d46b82e350bb8c566a07ed079c62fa87e2cce52125f7
MD5 d8b446d48ccd5af3faeb900fa83176fa
SHA1 44a666cc4f7dd4b50a63a4f0738982a4e97270a5
SHA512 5f037a0338dd3d388fba63360602673647e829828bea10e05f85d6864bfe20bc7a36375700a6c7d1660fb4eddb7315fcafcfb229944d9e79750e8a4c5f268203
SSDEEP 384:qDZcIhsNjUCP94OYEk0JJr1OcnTKwBODNZOCqU7:ghcqOh4cnewBKZO07
TLSH
T1E0928D705C386C779EE3B555F84B32174EB49177E6C82FA496EE7B2C00D65980307C22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 ef56ddd39041267423d4c2e892acae7704f33a595f0eb944e9064b7e33e1d321
MD5 aafd44c779295ae9dbb05dcdf5d119e6
SHA1 c3a338b2cc216b3a5f41fef05c513e0107e8c31a
SHA512 55f809d10ce8ef2f2816a7497ffd6f9ae98110b196c276a89194c3f233bbc82fc5255aab2c2de59cccc51948488f7fee88cf8954b5393ca79a39751dfcd0de66
SSDEEP 96:ZqONkiQsjpfmUTmDK5ih/cIPURHl8h4otop5rN5DrJBhPwivh50xy0SFYKQAxaYy:gON26kDfQmiUyrDZ903LPQiLFU6
TLSH
T1D602D7396C786CAB8EE3AE19F58677275FA5113BEAD52F81D9E81A1C40C764C1302827
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 20KB
SHA256 af76926c0fc060e7dccf789039c8d3756b4c72b24db1da84c9384bfe063be9f7
MD5 f4524949455cf405e14f1bc65933084a
SHA1 f8e9e9f3fbc8cfa9d521404c914ff95b8c02c0ae
SHA512 bd4a69e119940fa3383eb6386be6db0e3fa465fab76bc2602e103a6d670d770068624fc20b3f3ac07f1136b5e5319fb21e8fbe9778af0925159ea96515efbf1a
SSDEEP 384:prDZcIhsNjUHP94O8Ek0JJr1ycnTKwBODNZOCqU7:pvhJyOhMcnewBKZO07
TLSH
T1CB928D715C386C779EE3B555F88B32174FB49177E6C81FA496EEAB2C00DA5881307C22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 22KB
SHA256 c9e8c36b8f111f2589274bd38b31ac292f882dc67e22985e4276069d13e42cd8
MD5 6d6981b7110770a0d00182965b50fad8
SHA1 980beebaed36de54b561bee555dec8f8cbcd827e
SHA512 602e6f7085306dae25371730eca7ae857744346c06a526ed37cbf365112732dddde5ccd1028953e443980a99ca0403fa07d736f1615af634ecfee9ce1978ffd4
SSDEEP 384:xr2HiFiZcIszsNY8TUNTUlIlHP94O8Ek0JJr1pcnTKwBODNZOCqU7:xSCFQQNwgryOhfcnewBKZO07
TLSH
T124A28D725C68A97B9EF7AA55F94A32138FF451B7D6C46EA4E7EDAB1C00960CC0307C21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 a8285cee4aee0c5931a698977931417f893828b0a25929be34b912fbfe5b2321
MD5 10009927256cc85f96c595e27d2a5c39
SHA1 f5e8164366fcf0f7e17a802a7b49b4dfd1f6a857
SHA512 cf8e57bc1a4b295f3bdebc68eefd7d5905028327194b3576bebfb0b3b5ea999b687abf1c72514b4f59cb039a50d8859c5d9b5a0675bd24d5075d1cf6f9605f08
SSDEEP 192:/ONh6k4QmiUymDE903Lx1eYMSJr1TcRHiqcU6:/ONh6xxE90JJr10cU6
TLSH
T12A123A3168787C7B8DE3A864F48332239FA1413BEBC86F91D5EC2A1C05DB59C1307826
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

d1252fc6-b301-41f8-b1eb-c2ac278614ee.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\d1252fc6-b301-41f8-b1eb-c2ac278614ee.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 00efd9d1dc3b36c5ea98377e8cf3cbece3b25c944112252c4706fb32b1356f6e
MD5 c28a7e17250bf8445deadc6388f70c84
SHA1 b55ea3be25c5245f0530d3d7c8b3c2bcc1cd2226
SHA512 dd8558e83b1291783ad42767616a313e686920c09aebeb48e70d0bd912fa072594bfb9be54beabe43ac33ba5ab2b72395689b295cd43d79ddda98cf7844aa13f
TLSH
T1EB410558BAEA1154B3B76E5AABF6A86D447FB8372F46D45E00010D4F0A63A44C872737
MD5 SHA1 SHA512 TLSH

Submit Download