hxxps://xn--d1ani[.]xn--80afo5a[.]xn--p1acf/NWnPdB/

Analysis

max time kernel
148s
max time network
147s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
10/08/2026, 14:35

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://xn--d1ani.xn--80afo5a.xn--p1acf/NWnPdB/
Sample260810-rx4aba1bpd

Score

7^/10

discovery phishing

Malware Config

Signatures

A potential corporate email address has been identified in the URL: [email protected]
phishing
Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
984	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134308461593481289"	msedge.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2937465464-4167303362-2236413517-1000\{988D659C-26EB-4A61-B081-A7B4699675A0}	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1292	msedge.exe
1292	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
532	msedge.exe
532	msedge.exe
532	msedge.exe
532	msedge.exe
532	msedge.exe
532	msedge.exe
532	msedge.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
532	msedge.exe
532	msedge.exe
532	msedge.exe
532	msedge.exe
532	msedge.exe
532	msedge.exe
532	msedge.exe
532	msedge.exe
532	msedge.exe
532	msedge.exe
532	msedge.exe
532	msedge.exe
532	msedge.exe
532	msedge.exe
532	msedge.exe
532	msedge.exe
532	msedge.exe
532	msedge.exe
532	msedge.exe
532	msedge.exe
532	msedge.exe
532	msedge.exe
532	msedge.exe
532	msedge.exe
532	msedge.exe
532	msedge.exe
532	msedge.exe
532	msedge.exe
532	msedge.exe
532	msedge.exe
532	msedge.exe
532	msedge.exe
532	msedge.exe
532	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
532	msedge.exe
532	msedge.exe
532	msedge.exe
532	msedge.exe
532	msedge.exe
532	msedge.exe
532	msedge.exe
532	msedge.exe
532	msedge.exe
532	msedge.exe
532	msedge.exe
532	msedge.exe
532	msedge.exe
532	msedge.exe
532	msedge.exe
532	msedge.exe
532	msedge.exe
532	msedge.exe
532	msedge.exe
532	msedge.exe
532	msedge.exe
532	msedge.exe
532	msedge.exe
532	msedge.exe
532	msedge.exe
532	msedge.exe
532	msedge.exe
532	msedge.exe
532	msedge.exe
532	msedge.exe
532	msedge.exe
532	msedge.exe

Suspicious use of WriteProcessMemory 36 IoCs

description	pid	Process	procid_target
PID 532 wrote to memory of 4040	532	msedge.exe	88
PID 532 wrote to memory of 4372	532	msedge.exe	90
PID 532 wrote to memory of 984	532	msedge.exe	89
PID 532 wrote to memory of 4372	532	msedge.exe	90
PID 532 wrote to memory of 4372	532	msedge.exe	90
PID 532 wrote to memory of 1216	532	msedge.exe	92
PID 532 wrote to memory of 1216	532	msedge.exe	92
PID 532 wrote to memory of 508	532	msedge.exe	93
PID 532 wrote to memory of 508	532	msedge.exe	93
PID 532 wrote to memory of 3936	532	msedge.exe	94
PID 532 wrote to memory of 508	532	msedge.exe	93
PID 532 wrote to memory of 3936	532	msedge.exe	94
PID 532 wrote to memory of 3936	532	msedge.exe	94
PID 532 wrote to memory of 1648	532	msedge.exe	95
PID 532 wrote to memory of 1648	532	msedge.exe	95
PID 532 wrote to memory of 1648	532	msedge.exe	95
PID 532 wrote to memory of 2848	532	msedge.exe	96
PID 532 wrote to memory of 2848	532	msedge.exe	96
PID 532 wrote to memory of 2848	532	msedge.exe	96
PID 532 wrote to memory of 3716	532	msedge.exe	99
PID 532 wrote to memory of 3716	532	msedge.exe	99
PID 532 wrote to memory of 3716	532	msedge.exe	99
PID 532 wrote to memory of 3824	532	msedge.exe	100
PID 532 wrote to memory of 3824	532	msedge.exe	100
PID 532 wrote to memory of 4176	532	msedge.exe	101
PID 532 wrote to memory of 4176	532	msedge.exe	101
PID 532 wrote to memory of 3688	532	msedge.exe	103
PID 532 wrote to memory of 2072	532	msedge.exe	104
PID 532 wrote to memory of 2072	532	msedge.exe	104
PID 532 wrote to memory of 2072	532	msedge.exe	104
PID 532 wrote to memory of 5112	532	msedge.exe	108
PID 532 wrote to memory of 4308	532	msedge.exe	109
PID 532 wrote to memory of 2644	532	msedge.exe	110
PID 532 wrote to memory of 4848	532	msedge.exe	122
PID 532 wrote to memory of 4848	532	msedge.exe	122
PID 532 wrote to memory of 1292	532	msedge.exe	124

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://xn--d1ani.xn--80afo5a.xn--p1acf/NWnPdB/
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:532
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x24c,0x7ffaf801c188,0x7ffaf801c194,0x7ffaf801c1a0
  2⤵
  PID:4040
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1852,i,12410011574522243528,4327259987875030173,524288 --field-trial-handle=2336,i,5588499755047288400,15395832481497502539,262144 --variations-seed-version --mojo-platform-channel-handle=2372 /prefetch:3
  2⤵
  - System Time Discovery
  PID:984
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1684,i,5782738421052195592,15215801255087544428,262144 --field-trial-handle=2336,i,5588499755047288400,15395832481497502539,262144 --variations-seed-version --mojo-platform-channel-handle=2332 /prefetch:2
  2⤵
  PID:4372
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2604,i,11496667503270443864,3069447066041129069,524288 --field-trial-handle=2336,i,5588499755047288400,15395832481497502539,262144 --variations-seed-version --mojo-platform-channel-handle=2616 /prefetch:8
  2⤵
  PID:1216
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3436,i,3660253762758210779,15278434292275369213,2097152 --field-trial-handle=2336,i,5588499755047288400,15395832481497502539,262144 --variations-seed-version --mojo-platform-channel-handle=3464 /prefetch:1
  2⤵
  PID:508
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3444,i,16910378802038692960,8134736280721254855,2097152 --field-trial-handle=2336,i,5588499755047288400,15395832481497502539,262144 --variations-seed-version --mojo-platform-channel-handle=3492 /prefetch:1
  2⤵
  PID:3936
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4144,i,2337646308881343300,9067016825030465863,2097152 --field-trial-handle=2336,i,5588499755047288400,15395832481497502539,262144 --variations-seed-version --mojo-platform-channel-handle=4248 /prefetch:1
  2⤵
  PID:1648
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4252,i,5696910330999842904,17857152222645117975,2097152 --field-trial-handle=2336,i,5588499755047288400,15395832481497502539,262144 --variations-seed-version --mojo-platform-channel-handle=4300 /prefetch:2
  2⤵
  PID:2848
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=5032,i,16933540012037022971,11342870223498621217,2097152 --field-trial-handle=2336,i,5588499755047288400,15395832481497502539,262144 --variations-seed-version --mojo-platform-channel-handle=5020 /prefetch:1
  2⤵
  PID:3716
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5116,i,2876585326686029468,11312249463537701806,524288 --field-trial-handle=2336,i,5588499755047288400,15395832481497502539,262144 --variations-seed-version --mojo-platform-channel-handle=3400 /prefetch:8
  2⤵
  PID:3824
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3492,i,6379963527677833304,9910164978870551889,524288 --field-trial-handle=2336,i,5588499755047288400,15395832481497502539,262144 --variations-seed-version --mojo-platform-channel-handle=5152 /prefetch:8
  2⤵
  PID:4176
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5876,i,10282676048917464349,12624475163179300187,524288 --field-trial-handle=2336,i,5588499755047288400,15395832481497502539,262144 --variations-seed-version --mojo-platform-channel-handle=5892 /prefetch:8
  2⤵
  PID:3916
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5876,i,10282676048917464349,12624475163179300187,524288 --field-trial-handle=2336,i,5588499755047288400,15395832481497502539,262144 --variations-seed-version --mojo-platform-channel-handle=5892 /prefetch:8
  2⤵
  PID:3688
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --always-read-main-dll --metrics-shmem-handle=6232,i,5553214042558757406,5424980454458418159,2097152 --field-trial-handle=2336,i,5588499755047288400,15395832481497502539,262144 --variations-seed-version --mojo-platform-channel-handle=6240 /prefetch:1
  2⤵
  PID:2072
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3656,i,4877454210928612444,8330551569720147928,524288 --field-trial-handle=2336,i,5588499755047288400,15395832481497502539,262144 --variations-seed-version --mojo-platform-channel-handle=6388 /prefetch:8
  2⤵
  PID:5112
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4504,i,943609695851340725,2601426286200166622,524288 --field-trial-handle=2336,i,5588499755047288400,15395832481497502539,262144 --variations-seed-version --mojo-platform-channel-handle=4268 /prefetch:8
  2⤵
  PID:4308
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3596,i,5504990143436241586,17427356926282338390,524288 --field-trial-handle=2336,i,5588499755047288400,15395832481497502539,262144 --variations-seed-version --mojo-platform-channel-handle=5928 /prefetch:8
  2⤵
  PID:2644
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6420,i,9870414895188443142,401194196291767473,524288 --field-trial-handle=2336,i,5588499755047288400,15395832481497502539,262144 --variations-seed-version --mojo-platform-channel-handle=6524 /prefetch:8
  2⤵
  PID:4848
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6148,i,3955129910668062952,5654806789503917575,262144 --field-trial-handle=2336,i,5588499755047288400,15395832481497502539,262144 --variations-seed-version --mojo-platform-channel-handle=756 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1292

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:4400

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

blocklist

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\blocklist
Size 105KB
SHA256 4fbc0660f9f3056d5f36574b4004c58e5bf7b4539c8ad0bc0c3c5f5c791c776f
MD5 8410891e1250217cbd9dbe647ad5529f
SHA1 327802c1c5a4509900f7fe24316e0c502f8cbc38
SHA512 5034413d9345fbf305700f2a174f9c14d56e658cc489c615bb3e81afc0edbb449127f4aef51732eedfa1d11fb6ffa8cb919486fe9b500b19c34cebb226d0b956
SSDEEP 1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P7x:fwUQC5VwBIiElEd2K57P7x
TLSH
T1C6B3B931457E36BF26E93EE828CF1511B84F3912664895D4ABE1FE2C4845E68633CEF4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 3eacdfce7dc5d437b4447cf27ab297d2d39d13a22d53487691f060212cddb6b2
MD5 77a76342e47369b91c295856d0d136ad
SHA1 bac334fe99bd25a56aeb5cf09b273fd394730180
SHA512 5594ac61907f341c5e00a7e62a64d33fde684c855aa9b27d0c2756986334fbea5ebaf894d13dfedefe84d1f7ad65aaa17fb6b204714ed08460f06e4ed17ce733
TLSH
T1AAD012223A48F441DB4942709103CF453B26146024579A06E259D86D58B41D453D66C2
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 7aa2bb81937fdcdafd5d33143cfe61093f5233469b36757de171e12cc0c6215f
MD5 6503f091cfa7258a2190ed65490b1bdd
SHA1 d722a7fd3cd82ec30e4846b9511ec1c22b9dacfd
SHA512 5f2a6a53348e4e1b7810b77abe2dd4c597357ba365cf029977f0efbbb203eab9dfb7771c9edb3561b6d22c8b7354c34611905cfbaab36c763b9d3334beb40b4c
TLSH
T1BAD012223A48F441DB4942709102CF453B26146024579A06E259D86D58B51D453D66C2
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 73fbdb666a07eac22da56355cd41492202eadd194b57266f10bd096cf8e89c8d
MD5 5ed596b85f0de77d8c4598e19e3a3a5f
SHA1 43389bdfff8b65895edf5bfe27bca6068b3ccb28
SHA512 4daa5167f20a5bda056e89199de5d7b5e1158987fea2e5702fa81e1b071854ecd0bd8bce10577b15cd1fd620a441b12e0ca770d787af07d3c99dddee898624b7
TLSH
T13A81D644E6892D80E3511CB9EEF1B17530B288E40997CEC1D6144CFF270ABE94CAF407
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe589c3b.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe589c3b.TMP
Size 3KB
SHA256 a9008b459c6348e47597af1af20a9c467de72188b1ebda70a588dee34164bd47
MD5 05ad776cf0b4eb0ca55fa5a948e789d7
SHA1 8fb8a0e923d9982b2ce5e1fdd982362cf08b0263
SHA512 808d77f04d5269db810fcddbf1983186fb0f43c0855e1de1a91ab17786f7be041908e28b1a68d357b33763b90cef3caf548e62423438ad20d1fcdf129a7218e3
TLSH
T1F9717F59C64D0C91E7601CF9EEF2B27130B284C809A3CED5A51449FF670ABE98C6F407
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 6KB
SHA256 2ecdfc66987a1b0d91c88a9b3f41467685f637da8e916d92e6254f26d4100716
MD5 1572d6754d67a892003981be9559714f
SHA1 1b93e163503f993a386d54384088ec9401a92a19
SHA512 73804937fda50921624f372e51ae1838421f03b5e05e9f2d01d3d9a092bd12eaf93b71014307d91dd77c45ee80a68906186e7042c193cf1ee1b8f1483e37703f
SSDEEP 192:Dq35Q655dTC/2ln3CLZQlyYuMHal8YVKqRkjBYT:Dq35Q655dTC/2ln3CLZQlyYuMHayYVKm
TLSH
T1C5D19AF283E4867DC81252F19A547E1BDE5D1924432C3D4ACAECBF5F6BE2070E241A4E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 1d122152ac86ed7aa20de3c26a655ff94df0139dfbec4064bfeffbec10f91ae9
MD5 3cf0cb5bd96836f4d35c0179cd16ec49
SHA1 6e30412305897d4743bf715fdc40679e37a31fe5
SHA512 5461b967f57ad2be2de43c0df9dc57f6d23e7ec3d052dc7c4c45a0b2eb3d8d2627368dde189947c8e56689c2b7dfe2c091aa0a1886b5f44583116a6d4bfc14ca
SSDEEP 192:sxZfRoyM/jK1Ml8UQ+kE/fssgLtKIdpsXkcA6HW6+WNrAcG1Fp/YLSpjsIg5jJ:sxZfeqVE/fssgZDsHXHbr7k/iP
TLSH
T13E620811AA346977CDDBD219B901BF57E6F9447392910E44AAFCEE1C00E6BED220781F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 2fb05db72cacca021b17db24af7c6a38514a4788e4494ce91b3efaed27309159
MD5 c7e4f803595b6a9b029e09cde63b4af4
SHA1 40ebc5bda115564b7476dcf5ed991a8309d35d7c
SHA512 422a6dca979d47f67ee35b0cbbe7dbc16ee7b2ab0c685b0a3d9650f02f05d04c869a9647edc4d8e526e88ca42e32b2dc64f86628a025023b4f89208ef32e6bba
SSDEEP 192:sxZfRoyM/jK1Ml8MkE/fssKDtnIdpmXkcA6HW6+WNrAcG1Fp/YLQawsIgrJ:sxZfeME/fssKxomHXHbr7k/m9
TLSH
T1045219126A346977CDDBD209B905BB57D6F9047392900E94AAFCE91C00E6BED2307C1F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 30KB
SHA256 17d4c90c4d02e9e110b11df2d5424d8ffb8c85dff2397ea13b39db38771c5f80
MD5 d9a77c74a22d8fb599fdd62bdef54503
SHA1 038f5a86132e5da5bb36afd06d90b1af39aadd89
SHA512 8be5b0df1cbc25718b548da4ab4db2495a66871724429c0d8837dc1e9cc099f1c7be8e38ed7191f1d8cf37c8d5b6e0c3364cdb8ecf7072183489f1ef45d2a580
SSDEEP 768:oms6pD1WvxzWj8F1+UoAYDCx9Tuqh0VfUC9xbog/OVEILlWwJNRroTxC:oms6pD1WvxzWju1jahILIsNqTxC
TLSH
T1AFD2FA3B680CCB7E4F841E5CEC2AAF967DD801CBAB98895447FA444C03C77EA512759B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 5KB
SHA256 8864b8ba9add3f98989b1ae8b0540b1321d836cd4d5dfc8adde893b897e99a54
MD5 a5d927652a4d0748a1f57e64708894d6
SHA1 dca297a3668cd97aac7434e629f2a4236fc2af08
SHA512 eb670e1a1f38d51ee1b59552304e5adc6962146be110c90f5e6fcc35e279230125ef4da8cef1ee68b36e596ee9676df9c00bf8bc161673d94f60493ff0a4c468
SSDEEP 48:K0PY7/VpdktpmPImHkKzBb9k3f0oGVIyRwIvKFWcCyx6IvKfKQrylrIdKA8wD:KUAAKtePiwQKFWvC6EKfKuurmKA84
TLSH
T174C11C12717B0A023D7E2B0CA255872A97427273305CA92B3BED44754DAEE394DFC5ED
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig~RFe58f46d.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig~RFe58f46d.TMP
Size 3KB
SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
MD5 904e6e94a1d46374c8630cfd86cc729f
SHA1 e1d9c3f7813878acc6510d48d95b2bf48b2e1a0d
SHA512 081e2a26252860ff8d8f7a9d0378ae56f0cc50574d13d2a121afdf74284963747ef874a4d73b1df7774cd8570972f4f513eefe0a0325fd088556d5b1ba946712
TLSH
T1DB815C4FCC0CBE77ABAB6A719A35D6B2F79131EA94518A977F8C444EE3050ED0242E50
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 27KB
SHA256 1f9c578b18ea319d623015a76d5d29f9015bcebb507391dc4089202bd92719d6
MD5 364f1211b8c9d8360b9380d0e3753f62
SHA1 cac4a3c6993eea10abf006cba1adb4d9de77b73c
SHA512 ca343ca1f7b4944af371faf8240822c38bdf9075872c841640086147d2f4e48e72475b42abd29ea0cc2d91c6efba46e80097c1e850f48eff23efe85479cdf1cc
SSDEEP 384:FiFiZcI5zsN+8TUNTUlIlXjfCQa99d/VfSBtR6HlytEDq1UMWvu:MFQ5XwgUZfzSBtRoy6DqXW2
TLSH
T1B0D22BF248E7583ADAAE5703E77E2D074EBDC063B5956A90B3D8990CCC961BFD306811
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 20KB
SHA256 7a08e65bcb77617198ccdaa35a9af4adb7a5e8b5301cae7a7b0eef94ae210959
MD5 cd1e8bc2e419863db3e205f0ca184eec
SHA1 46e657c66f25ff3ab34007db4aff6e94acf84a21
SHA512 799fedb875e90f9deb86b888a7bf1294f7472a8ed93a4005907046ff20e4411b6f4296d16eff0f8b16ba140577984b4ec30faa4bcace2c37cdb7e9331311fb35
SSDEEP 384:vZcIhsNuXjfWQa99d/VfhBtR6HlytEDq1UMWvu:nhAZfzhBtRoy6DqXW2
TLSH
T181928D315D786C7B4AB7B101F88B39175FF89077A7E92F94A1ECAF0C00DA5A9130B916
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 35f0d26825cd90a0c27422755ec9b225106a298c753b16124343d85b302ca0c5
MD5 de0fafac062c4825045f2f2863729a57
SHA1 c36ddc4a91602ff92d3b2df70e5b5b97d3bd485b
SHA512 cf382c7afe083514139f56686b8edfe0d98c7fb475d13e14f5136f690ea096d87b714950afcabe2c3e297aa1b5894d6cb96e246afc4bdd2212947bffad0f7866
SSDEEP 192:qONt6O7+3hQmiUygbGttb0j+Fd/9UgGB76W8rU6:qONt61rGt99d/9aB7t8rU6
TLSH
T1A802E7356C786CB78EB2AD49F58727275FA5117BE9A62F80D6E81E0C00D766C2343C27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 8aa022793a84044a64c5eeca199999d2904f6719e3158f9fc8516a5f88eeaf78
MD5 dd977a76a4a9b0efff9acae2c38da262
SHA1 2d91a40bc6d0ced7ed00c3c24739853ad6012957
SHA512 5f0d6d02b6ac4f1c8a37521fa523de21a5e867c298121e442ed317746dc1bcfb853f1a76dd631821a11fbb1fae0c60fe5bdb6f60e75a339024ffaff85d60c2c0
SSDEEP 192:gONf6O7+3EQmiUylbQttb0j+Fd/cQzDRwcNBFqqSqU6:gONf6ioQt99d/Vf7BtRU6
TLSH
T11A1219356C686C6B4EA3A445F58736175FA5417BEA8B3F90D5DC6E0C00EB56C230BC17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 19KB
SHA256 93988418c3da6b624ce69057051281db18712edf4b37092071d8380984ba4f15
MD5 342914c417223dd9b16e8eab4944de38
SHA1 5c1354561534a36f6b752145a37b2d6528f3eabc
SHA512 1179dec8c7ec285a23aef736ae03d902e0c741205a14bdcab2affdce9d9617ebef2b10dac7af58c0f2f138e9adff63c1637e1b30aa03dedf175e9ead3e76bff0
SSDEEP 384:MZcIhsNuvjfWQa99d/VfhBtR6HlytEDq1UMWvu:ahMZfzhBtRoy6DqXW2
TLSH
T170928D315D786C7B4AB7B105F48B36175FF89037AAD92F94E1ECAF0C00DA5A9130B916
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

2383679f-8148-4ca1-9f34-e6c3b6a36793.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\2383679f-8148-4ca1-9f34-e6c3b6a36793.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 2b314897db8fb07241c87aec2efa58f5b92891fcb49500898493d5a02ee677a7
MD5 f986f167e4002125f0e7b9207069f8f0
SHA1 66d04df2eaa06f795951ae04b6937ff8a348e47b
SHA512 cf7402c0fa2e53e52c96e0473feca574f1701c39ad99012a04934a1787a11511adf160c6ca26e6e452c254de82e433216c92253898d7b199aa94d7f98fd1a91e
TLSH
T123410B58B6FE0148B3B7AE469BF679AE447FB9372E0BD45D10110E4E0626A40C872B33
MD5 SHA1 SHA512 TLSH

Submit Download