658208cf6135a7bcee3de698320d9f3aa0a85c28418c56a9bdceed2be9f1b6ac

Analysis

max time kernel
148s
max time network
156s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
07/08/2026, 12:19

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
bigsale/fast-add.html
Size 5KB
Sample260807-phacksfg47
SHA256 658208cf6135a7bcee3de698320d9f3aa0a85c28418c56a9bdceed2be9f1b6ac
MD5 45e4891369b4d318e888d18c645d4aa7
SHA1 99e0d7458c83ef6977869700631a173a4e8e08b0
SHA512 758b5649b25e1f57ae388f8f550a5b1b9a576ba942e989bafbe599c795cd39f3b81005041c0ef4977efa2f7aa7ab2d666ac6141513505fc16350defef3204cdb
SSDEEP 96:r5plwftmo+hWTMctJZveWJkOg/vfvfvEvN6qpzrtsUATx/BNqRM7ME8L:r5paftmo+hWTMctPveWJwnncEgSU4x/i
TLSH
T1FDB1853771F10054A69391A86A53878A3E28D2039F06AC697C4C95E1DF6FE5682FB3DC
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4920	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134305788211813877"	msedge.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2370214745-1838013427-2987045292-1000\{9FD4BA8A-0B4F-4E72-B45B-E42AD5839ED1}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4320	msedge.exe
4320	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
4128	msedge.exe
4128	msedge.exe
4128	msedge.exe
4128	msedge.exe
4128	msedge.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
4128	msedge.exe
4128	msedge.exe
4128	msedge.exe
4128	msedge.exe
4128	msedge.exe
4128	msedge.exe
4128	msedge.exe
4128	msedge.exe
4128	msedge.exe
4128	msedge.exe
4128	msedge.exe
4128	msedge.exe
4128	msedge.exe
4128	msedge.exe
4128	msedge.exe
4128	msedge.exe
4128	msedge.exe
4128	msedge.exe
4128	msedge.exe
4128	msedge.exe
4128	msedge.exe
4128	msedge.exe
4128	msedge.exe
4128	msedge.exe
4128	msedge.exe
4128	msedge.exe
4128	msedge.exe
4128	msedge.exe
4128	msedge.exe
4128	msedge.exe
4128	msedge.exe
4128	msedge.exe
4128	msedge.exe
4128	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
4128	msedge.exe
4128	msedge.exe
4128	msedge.exe
4128	msedge.exe
4128	msedge.exe
4128	msedge.exe
4128	msedge.exe
4128	msedge.exe
4128	msedge.exe
4128	msedge.exe
4128	msedge.exe
4128	msedge.exe
4128	msedge.exe
4128	msedge.exe
4128	msedge.exe
4128	msedge.exe
4128	msedge.exe
4128	msedge.exe
4128	msedge.exe
4128	msedge.exe
4128	msedge.exe
4128	msedge.exe
4128	msedge.exe
4128	msedge.exe
4128	msedge.exe
4128	msedge.exe
4128	msedge.exe
4128	msedge.exe
4128	msedge.exe
4128	msedge.exe
4128	msedge.exe
4128	msedge.exe

Suspicious use of WriteProcessMemory 32 IoCs

description	pid	Process	procid_target
PID 4128 wrote to memory of 3172	4128	msedge.exe	83
PID 4128 wrote to memory of 4920	4128	msedge.exe	84
PID 4128 wrote to memory of 2608	4128	msedge.exe	85
PID 4128 wrote to memory of 2608	4128	msedge.exe	85
PID 4128 wrote to memory of 2608	4128	msedge.exe	85
PID 4128 wrote to memory of 1020	4128	msedge.exe	87
PID 4128 wrote to memory of 1020	4128	msedge.exe	87
PID 4128 wrote to memory of 1960	4128	msedge.exe	88
PID 4128 wrote to memory of 3912	4128	msedge.exe	89
PID 4128 wrote to memory of 1960	4128	msedge.exe	88
PID 4128 wrote to memory of 1960	4128	msedge.exe	88
PID 4128 wrote to memory of 3912	4128	msedge.exe	89
PID 4128 wrote to memory of 3912	4128	msedge.exe	89
PID 4128 wrote to memory of 4176	4128	msedge.exe	90
PID 4128 wrote to memory of 4420	4128	msedge.exe	91
PID 4128 wrote to memory of 4176	4128	msedge.exe	90
PID 4128 wrote to memory of 4176	4128	msedge.exe	90
PID 4128 wrote to memory of 4420	4128	msedge.exe	91
PID 4128 wrote to memory of 4420	4128	msedge.exe	91
PID 4128 wrote to memory of 3956	4128	msedge.exe	97
PID 4128 wrote to memory of 4408	4128	msedge.exe	98
PID 4128 wrote to memory of 3956	4128	msedge.exe	97
PID 4128 wrote to memory of 4408	4128	msedge.exe	98
PID 4128 wrote to memory of 3948	4128	msedge.exe	100
PID 4128 wrote to memory of 2468	4128	msedge.exe	107
PID 4128 wrote to memory of 888	4128	msedge.exe	108
PID 4128 wrote to memory of 3408	4128	msedge.exe	109
PID 4128 wrote to memory of 804	4128	msedge.exe	110
PID 4128 wrote to memory of 804	4128	msedge.exe	110
PID 4128 wrote to memory of 540	4128	msedge.exe	112
PID 4128 wrote to memory of 540	4128	msedge.exe	112
PID 4128 wrote to memory of 4320	4128	msedge.exe	115

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument C:\Users\Admin\AppData\Local\Temp\bigsale\fast-add.html
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4128
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x24c,0x7ffc8e4dc188,0x7ffc8e4dc194,0x7ffc8e4dc1a0
  2⤵
  PID:3172
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1876,i,14395249890376846202,3655392840713052754,524288 --field-trial-handle=2140,i,2073410981005115233,12365261657762041990,262144 --variations-seed-version --mojo-platform-channel-handle=2180 /prefetch:3
  2⤵
  - System Time Discovery
  PID:4920
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1640,i,17024272366349159606,15673249898591315408,262144 --field-trial-handle=2140,i,2073410981005115233,12365261657762041990,262144 --variations-seed-version --mojo-platform-channel-handle=2136 /prefetch:2
  2⤵
  PID:2608
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2648,i,14740337215225442294,16846032217731189134,524288 --field-trial-handle=2140,i,2073410981005115233,12365261657762041990,262144 --variations-seed-version --mojo-platform-channel-handle=2704 /prefetch:8
  2⤵
  PID:1020
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3456,i,6272980328884150880,4883670973215997647,2097152 --field-trial-handle=2140,i,2073410981005115233,12365261657762041990,262144 --variations-seed-version --mojo-platform-channel-handle=3500 /prefetch:1
  2⤵
  PID:1960
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3476,i,13222590168848695434,12791422822600646947,2097152 --field-trial-handle=2140,i,2073410981005115233,12365261657762041990,262144 --variations-seed-version --mojo-platform-channel-handle=3528 /prefetch:1
  2⤵
  PID:3912
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4244,i,10542347882428771072,8071767553590601752,2097152 --field-trial-handle=2140,i,2073410981005115233,12365261657762041990,262144 --variations-seed-version --mojo-platform-channel-handle=4296 /prefetch:1
  2⤵
  PID:4176
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4280,i,2415508458516472058,17035987770762672658,2097152 --field-trial-handle=2140,i,2073410981005115233,12365261657762041990,262144 --variations-seed-version --mojo-platform-channel-handle=4344 /prefetch:2
  2⤵
  PID:4420
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5144,i,4565615086768300209,10317630899019988343,524288 --field-trial-handle=2140,i,2073410981005115233,12365261657762041990,262144 --variations-seed-version --mojo-platform-channel-handle=5200 /prefetch:8
  2⤵
  PID:3956
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5148,i,18042722738136779112,4480410051185472761,524288 --field-trial-handle=2140,i,2073410981005115233,12365261657762041990,262144 --variations-seed-version --mojo-platform-channel-handle=5204 /prefetch:8
  2⤵
  PID:4408
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5832,i,18300674122941053704,5631993421961449996,524288 --field-trial-handle=2140,i,2073410981005115233,12365261657762041990,262144 --variations-seed-version --mojo-platform-channel-handle=5864 /prefetch:8
  2⤵
  PID:1812
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5832,i,18300674122941053704,5631993421961449996,524288 --field-trial-handle=2140,i,2073410981005115233,12365261657762041990,262144 --variations-seed-version --mojo-platform-channel-handle=5864 /prefetch:8
  2⤵
  PID:3948
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4892,i,14867311292175335225,12278723604306130653,524288 --field-trial-handle=2140,i,2073410981005115233,12365261657762041990,262144 --variations-seed-version --mojo-platform-channel-handle=4320 /prefetch:8
  2⤵
  PID:2468
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4376,i,2433609528045294664,17862237904674465995,524288 --field-trial-handle=2140,i,2073410981005115233,12365261657762041990,262144 --variations-seed-version --mojo-platform-channel-handle=4888 /prefetch:8
  2⤵
  PID:888
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4312,i,8257739691392202109,11289840490599314855,524288 --field-trial-handle=2140,i,2073410981005115233,12365261657762041990,262144 --variations-seed-version --mojo-platform-channel-handle=4472 /prefetch:8
  2⤵
  PID:3408
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4580,i,13673989419506800167,6092854989689591765,524288 --field-trial-handle=2140,i,2073410981005115233,12365261657762041990,262144 --variations-seed-version --mojo-platform-channel-handle=5424 /prefetch:8
  2⤵
  PID:804
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2124,i,6756568648175584731,5362647854031091228,524288 --field-trial-handle=2140,i,2073410981005115233,12365261657762041990,262144 --variations-seed-version --mojo-platform-channel-handle=5500 /prefetch:8
  2⤵
  PID:540
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6184,i,14819449853092119774,17987038950284905288,262144 --field-trial-handle=2140,i,2073410981005115233,12365261657762041990,262144 --variations-seed-version --mojo-platform-channel-handle=6208 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4320

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:3028

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

blocklist

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\blocklist
Size 105KB
SHA256 cc6205dfc0ad92d30fb9ee805c729d53c836cff0462f2e045a52fbf9353b96ba
MD5 f562913e5926d98801f903f9ab792282
SHA1 8891dadd21fb366e56ca3e18b52a40681e1c6bd5
SHA512 4b1aaca6f81fabe0474d092b453cb6d7540505c123db6a819cbbd5d6f8b61b43326519262ad010d1ef93e3bc712b9067ba041231fbb887f2053b2fb964c01056
SSDEEP 1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P7w:fwUQC5VwBIiElEd2K57P7w
TLSH
T12AB3B931457E36BF26E93EE828CF1511B84F3912664895D4ABE1FE2C4845E68633CEF4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 39b8627875fea5ac5c5bfb887da12c15116e3fe81f200852c71d5699102c9044
MD5 e3962be2eb3bd350a67bf6309159a1cc
SHA1 c10632202b95ed6f7f4475b6483bf5196e4c5578
SHA512 d12d4acc23b51c071fbc9bf4db2f0575a6b43ec7894b272035e4c01dfce30099cd3ef90a1009dd1e6284cfbcf7a37fd3b79490739946700a2c61ec578374cbe6
TLSH
T173D08C677A0E7815E72F8231A413E360A76B4072A5629702F324C81DA9BC8D85BE63D7
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 a59087fbda784cffb013f4e2a0bf13a7fca483c48e8a7fc15fa022402eb25d72
MD5 dd54db185d82309b854bfa7657ba4600
SHA1 d01c14e8b4dec85ed2e1671545a868fd7ad4fa95
SHA512 f014ab84dd934b90e006883b74ad349d05f60071e57d2cf0bdf8a9bce118654c92139263e082094b602f6900a71e9a7848754994a2ea88642b2376121b581d07
TLSH
T165D08067354D7815E71F42319413D350576B4072A562D702F314C41D957C4D857D53D7
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 9c16480b6dff6a147bba21ec0050e4d77196ac25923220d9842915ab2d456746
MD5 7a8dfb2f2b09b529f398f198a5bc463c
SHA1 bab74f916bb0d22e0c89c4a5516745c1089da062
SHA512 3bd94109b2a4bddcc53862cef04051b91fa99f913c46958d2155e29dfd109e20b488e9b31976bc4e9afd72cb2a80259a6493ab9d3521fdf79f5a6ec39d7507e3
TLSH
T10261090A0D8E1984F3A93139A3D243C239B1C4AB19DF9E170253D6BBE91271D4C26DFB
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe587a6b.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe587a6b.TMP
Size 3KB
SHA256 c371307cb79f8d42f717abc164cd57d89802ada0698c1d67b5756043c985619e
MD5 8d22d6319cdd532b1db00260f256d82b
SHA1 ce6b3eaae993cc4f551f23ae18c21509316b1aa2
SHA512 fcf07938406cde900d6e41f191691a70395756e0fa77294fa1d483823e8e0834c444d6d76e13c9bdea3839d9b99aca2cf93e7ef01d1511a508e4b810a61f5f51
TLSH
T129611A0A0D8E1984F3A93138A3D243C239B5C4AB59DF9E170153D6BBE91271D5C26DFB
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 733B
SHA256 4299b340aa31a6f2e897238612276255ca07d86f98bca5377eb8895818e843cc
MD5 f775094c689de578257c941f63668ffa
SHA1 1f0c8dc338a7a4161af6a77e630c474e65a10ea4
SHA512 dde2fc7bbadfb1c73472abc9edae3f61aa1b3b1354ac931baf76dd04abf15cb404e781d462c0e284c1f5704cc737d1e06bcf2f57b32944813fb24a48f89f5062
TLSH
T1F10190F7C3E4956E890057F06A14AE17CE2C0506431C7C15C5D4BF2B97E3475D10195B
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 acffc433361f5bc675a49431cd254b52b1d87bc4c24a211fa7aad54166f92660
MD5 5347bde63d72dc9193cd87a25d20dee6
SHA1 623ab4874f894e34bf8082b7efc1533cc39abe86
SHA512 43a3367d707da5fbcd99f9267d94784dcd1848da6b730752073df30dc13d7697e6ebf11235b64e02f3c7d4597b33672f2b5211095fcb8fbdc1c578777bc6d4d1
SSDEEP 192:sxZunR+yM/jK1Ml8Mkb/fXsxCLqIdpd2HW6+WNGYHjHVwIgrJ:sxZmcMb/fXsQLjIHbGD9
TLSH
T183420816AB34A977CCCBD209FA557F53D6F54432A2940E44E9FCDA1C04E6AED220782F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 a6dea5e538ddba95707bbd2c11cebc3c644e7f4107581e8ae3c14f5cbe281d69
MD5 08deb2a156413265dc4111deb3430c6f
SHA1 7b6b536252a6df91a44d45a9d26b69d0c2055756
SHA512 b5ecc106b5f2b5be11503defe3c2c3b374b076ad13f0c53b88105af5c56a295051fa43372ab075bf4484989807a24af02e46adaf533ba60de9ada7174119718f
SSDEEP 192:sxZunR+yM/jK1Ml8UQGkb/fXsaCGqIdpH2HW6+WNGYHl82FwIg59J:sxZmcqtb/fXsRGjWHbGg0N
TLSH
T16E521916AA389977CCCBD20DFA417F53D6F44432A1940E84A9FCDA1C04E7AED220782F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 30KB
SHA256 bd070ad427408765adfe02572629fdb57758e60ee6db6133e3d34b60b46daf75
MD5 3eff8a8d542cb5d2e953198edc5f5b86
SHA1 afc17c5aa9fe1ed2ae5f435658e289a8ebc62d38
SHA512 afc80147010b450b0aea1ff215adc3f778dadf28dcf81651f61875d0f52d9f29dd6d9d3d38cf3c45688a0388e2a742517b8aa824f483b1a403e8b2efb4792401
SSDEEP 768:RsUZYTMWvg0Po8F1+UoAYDCx9Tuqh0VfUC9xbog/OVOeLlPZ4ROroV00e:RsUZYTMWvg0Pou1ja7eLZmRFBe
TLSH
T1BBD20A2F280CCB7E4F844E5DEC2A6F963ED801CB5A584D5447EA894C03CB7EB512B59B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 5KB
SHA256 708100e3890ec6862f5becd5cd4dd78ff8c82e3791112b876abb63e814d8e948
MD5 97f9b466d3e0f80b55e2c73b3c68b9ae
SHA1 9be7c0c43da88bc5b96067c0573c2ab84a80022d
SHA512 c74b2405266da1bc49213999222f0152989721de7cb30e355a032642636db98fbf00f33579047182310aa286b6e25d5b7fea724eb8e7b57572f63ed606c0d162
SSDEEP 48:KA1ItK2AIHIdKUMgHypa/MAac8hZ8yI/KDyQ/yNDIlKA8AV:KA1eK2AIHuKUMSeCycKDySuDeKA8+
TLSH
T1F4C1264371BA56933C7F6A08829487278E42B3637158E46B7FAC50B24D67E209CFD8DD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 20KB
SHA256 b123e017ad99ffb5cb73b3b1310a8330ddf0b6b428eab97a96c51191fbdd7ce7
MD5 a3277ad01c6ae5955dc93bdd31d9914e
SHA1 b8e32b70894a4acbce2c8de2a421818e6c29a329
SHA512 678ad736d73d17d2eba79215a562c76422e16e12ed7fbcb744780f5854c3fc0e224f5a62fdc2102278afaa3c22c2dd133d1df0e2c8e1f766991c71af7b43b9fa
SSDEEP 384:bZcIHzsNUZIhfQezX5od+a8O1XFeDkf5UrzXl:DTryOVFeDkS1
TLSH
T1B9927D75AC78AC3799E6F584B84633039FF89027E6892BD4D6EC6F2C009E55C130782B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 19KB
SHA256 df4971b92e3eff4eae894cc1fcc855d52e774924f737a31304b2a87790ce9c1c
MD5 9de228b45dc0d03c749a657ad7877d31
SHA1 a3029cdfb0195c54be3bd8d39196b12d2b7857b5
SHA512 f0adec7aef9fbc7b075e657b4a2025f033d04789a03cb3f8b150f645b18cac29fc97bd04e00491d489fb734d85c7fe171ed7502a234a64fa662d8f16455af072
SSDEEP 384:mZcIhsNU9IhfQezX5od+a8O1XzCDkf5UrzXl:0h3yOVzCDkS1
TLSH
T14F927D75AC78AC7759E6F584B84633039EF89127E6852B94D5EC6F2C01AE1AC130782B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 cc28d9d6e5727d660a2af06bcb274d5e47bde12972c10d8c8a04ebc33579b31d
MD5 232e1967dc6d1976bd942fe5fbe6000a
SHA1 655b02a26c42ff3460d4a9efc6ab195352a82266
SHA512 8f55e10a31947b237cfa336a67c3329d079fb7bad93fe069eaae83bcb6a1696257a331f212e0c819b5cf67bd087efbe6d184ec25337a80b68fc4dbf794dd30c7
SSDEEP 192:yONb61VWQmiUyUOgGX5Obd+jCjzorOyR5/aDV3MYU6:yONb6WAgGX5od+a8OTDmYU6
TLSH
T12302C735A9687C7B8AE2AE49B48737135FE4206BEA956F84D6EC1F1C00D765C2306837
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 4b72206e16bbb4d8859b620d9349d006700c0aa479964857e06856f63e83ab41
MD5 e7691e56bfe01f85f5d8838a9a3ce39a
SHA1 ad6371b4c977d9328b4a48d8e5cddc72a838b5ae
SHA512 830f8eb557138aba7fa9497d7687b35a0e53fe6ea838278babcc8a316f1b6fc3a717cff7214550111ccc23e1d725dacffc98f1e7634050c3a0292877e79ec155
SSDEEP 192:2ONt61fWQmiUy5OaGX5Obd+jCjzorOyRwXQjJDxqFU6:2ONt6kDaGX5od+a8O1XoDkU6
TLSH
T1A8120A32A968BC6B4DE2F954B48736135EA55127EA896F90D6EC2F1C00DF65C130BC27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 20KB
SHA256 8165f4de17e08f86869e9a0600aa5f99fe865aa35373bc2a5b34be4962798e35
MD5 a49cb2a11339cb4b95e55785102cccbd
SHA1 6f279b0a5665a532003cb99765724d997ba59f9d
SHA512 52823cd08da1271ce6fb864dcc83932f701ba39af655f67332fb5c4b568000d721cd1f184cdcf7193f45e6526a58ea18d36891445682d82fb6dbc564836a1e7d
SSDEEP 384:dZcIhsNUZIhfQezX5od+a8O1XzCDkf5UrzXl:FhryOVzCDkS1
TLSH
T1E8927D75AC78AC3759E6F584B84633039FF89127E6892BD4D6EC6F2C01AE55C130782B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\metadata.json
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 0c8beb56da65530426c54443a2ba8dfefaae75cea9f7e4295445f003a1b31667
MD5 8a5e4e7cf3e8df0a8874bedcbabf1347
SHA1 0496386a9a54c2ad1dc1b2eea3f7c753a20bc1e0
SHA512 a1f165859267e7147020f7a8b454b80926e4230eea9161ae1ac717f9ac89799f30e83efa308a1dbbd1b8e92ee7d9268add267dc2190bcc5f8d92f55e11c9ac47
TLSH
T1CA412759A6FA1108B3B7AF569BF7A86D487BBC372E06D05E10010D4E0A27E41CC72737
MD5 SHA1 SHA512 TLSH

Submit Download