hxxp://baidu[.]com

Analysis

user interaction
yes
max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
10/08/2026, 17:08

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
http://baidu.com
Sample260810-vnqjmstdqe

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4520	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134308553220123612"	msedge.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-668679576-120646659-2289335452-1000\{2EA354EB-943F-47A5-8E24-1766A88B9180}	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2540	msedge.exe
2540	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
4072	msedge.exe
4072	msedge.exe
4072	msedge.exe
4072	msedge.exe
4072	msedge.exe
4072	msedge.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
4072	msedge.exe
4072	msedge.exe
4072	msedge.exe
4072	msedge.exe
4072	msedge.exe
4072	msedge.exe
4072	msedge.exe
4072	msedge.exe
4072	msedge.exe
4072	msedge.exe
4072	msedge.exe
4072	msedge.exe
4072	msedge.exe
4072	msedge.exe
4072	msedge.exe
4072	msedge.exe
4072	msedge.exe
4072	msedge.exe
4072	msedge.exe
4072	msedge.exe
4072	msedge.exe
4072	msedge.exe
4072	msedge.exe
4072	msedge.exe
4072	msedge.exe
4072	msedge.exe
4072	msedge.exe
4072	msedge.exe
4072	msedge.exe
4072	msedge.exe
4072	msedge.exe
4072	msedge.exe
4072	msedge.exe
4072	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
4072	msedge.exe
4072	msedge.exe
4072	msedge.exe
4072	msedge.exe
4072	msedge.exe
4072	msedge.exe
4072	msedge.exe
4072	msedge.exe
4072	msedge.exe
4072	msedge.exe
4072	msedge.exe
4072	msedge.exe
4072	msedge.exe
4072	msedge.exe
4072	msedge.exe
4072	msedge.exe
4072	msedge.exe
4072	msedge.exe
4072	msedge.exe
4072	msedge.exe
4072	msedge.exe
4072	msedge.exe
4072	msedge.exe
4072	msedge.exe
4072	msedge.exe
4072	msedge.exe
4072	msedge.exe
4072	msedge.exe
4072	msedge.exe
4072	msedge.exe
4072	msedge.exe
4072	msedge.exe

Suspicious use of WriteProcessMemory 37 IoCs

description	pid	Process	procid_target
PID 4072 wrote to memory of 3588	4072	msedge.exe	86
PID 4072 wrote to memory of 4520	4072	msedge.exe	87
PID 4072 wrote to memory of 1016	4072	msedge.exe	88
PID 4072 wrote to memory of 1016	4072	msedge.exe	88
PID 4072 wrote to memory of 1016	4072	msedge.exe	88
PID 4072 wrote to memory of 2728	4072	msedge.exe	90
PID 4072 wrote to memory of 2728	4072	msedge.exe	90
PID 4072 wrote to memory of 768	4072	msedge.exe	91
PID 4072 wrote to memory of 768	4072	msedge.exe	91
PID 4072 wrote to memory of 768	4072	msedge.exe	91
PID 4072 wrote to memory of 2656	4072	msedge.exe	92
PID 4072 wrote to memory of 2656	4072	msedge.exe	92
PID 4072 wrote to memory of 2656	4072	msedge.exe	92
PID 4072 wrote to memory of 552	4072	msedge.exe	93
PID 4072 wrote to memory of 552	4072	msedge.exe	93
PID 4072 wrote to memory of 552	4072	msedge.exe	93
PID 4072 wrote to memory of 1064	4072	msedge.exe	94
PID 4072 wrote to memory of 1064	4072	msedge.exe	94
PID 4072 wrote to memory of 1064	4072	msedge.exe	94
PID 4072 wrote to memory of 3636	4072	msedge.exe	98
PID 4072 wrote to memory of 3900	4072	msedge.exe	99
PID 4072 wrote to memory of 3636	4072	msedge.exe	98
PID 4072 wrote to memory of 3900	4072	msedge.exe	99
PID 4072 wrote to memory of 3824	4072	msedge.exe	101
PID 4072 wrote to memory of 4300	4072	msedge.exe	102
PID 4072 wrote to memory of 4300	4072	msedge.exe	102
PID 4072 wrote to memory of 4300	4072	msedge.exe	102
PID 4072 wrote to memory of 1192	4072	msedge.exe	111
PID 4072 wrote to memory of 1192	4072	msedge.exe	111
PID 4072 wrote to memory of 1064	4072	msedge.exe	114
PID 4072 wrote to memory of 3392	4072	msedge.exe	115
PID 4072 wrote to memory of 2536	4072	msedge.exe	116
PID 4072 wrote to memory of 5996	4072	msedge.exe	123
PID 4072 wrote to memory of 5996	4072	msedge.exe	123
PID 4072 wrote to memory of 5160	4072	msedge.exe	124
PID 4072 wrote to memory of 5160	4072	msedge.exe	124
PID 4072 wrote to memory of 2540	4072	msedge.exe	128

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument http://baidu.com
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4072
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x234,0x23c,0x240,0x238,0x264,0x7ffad1c8c188,0x7ffad1c8c194,0x7ffad1c8c1a0
  2⤵
  PID:3588
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1804,i,16391157812699432071,12641323444443090705,524288 --field-trial-handle=2288,i,6460187935949786489,9190322025463579146,262144 --variations-seed-version --mojo-platform-channel-handle=2316 /prefetch:3
  2⤵
  - System Time Discovery
  PID:4520
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1684,i,10016200579781215307,16212014814186225527,262144 --field-trial-handle=2288,i,6460187935949786489,9190322025463579146,262144 --variations-seed-version --mojo-platform-channel-handle=2284 /prefetch:2
  2⤵
  PID:1016
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2584,i,4011215698640082615,7256375242558025754,524288 --field-trial-handle=2288,i,6460187935949786489,9190322025463579146,262144 --variations-seed-version --mojo-platform-channel-handle=2764 /prefetch:8
  2⤵
  PID:2728
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3420,i,6396209917891826226,1504883368768496765,2097152 --field-trial-handle=2288,i,6460187935949786489,9190322025463579146,262144 --variations-seed-version --mojo-platform-channel-handle=3468 /prefetch:1
  2⤵
  PID:768
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3436,i,2389980952241438189,11130001907291359293,2097152 --field-trial-handle=2288,i,6460187935949786489,9190322025463579146,262144 --variations-seed-version --mojo-platform-channel-handle=3480 /prefetch:1
  2⤵
  PID:2656
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4176,i,9895682845015427855,9285933326856662372,2097152 --field-trial-handle=2288,i,6460187935949786489,9190322025463579146,262144 --variations-seed-version --mojo-platform-channel-handle=4188 /prefetch:1
  2⤵
  PID:552
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4208,i,16997525707389048415,10671951021954967725,2097152 --field-trial-handle=2288,i,6460187935949786489,9190322025463579146,262144 --variations-seed-version --mojo-platform-channel-handle=4168 /prefetch:2
  2⤵
  PID:1064
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5124,i,7350953043240711296,9820731102240111822,524288 --field-trial-handle=2288,i,6460187935949786489,9190322025463579146,262144 --variations-seed-version --mojo-platform-channel-handle=5168 /prefetch:8
  2⤵
  PID:3636
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5132,i,10917812672371246567,3752810777093857488,524288 --field-trial-handle=2288,i,6460187935949786489,9190322025463579146,262144 --variations-seed-version --mojo-platform-channel-handle=5216 /prefetch:8
  2⤵
  PID:3900
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5924,i,17550955462376991029,16162654235687132733,524288 --field-trial-handle=2288,i,6460187935949786489,9190322025463579146,262144 --variations-seed-version --mojo-platform-channel-handle=5956 /prefetch:8
  2⤵
  PID:3532
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5924,i,17550955462376991029,16162654235687132733,524288 --field-trial-handle=2288,i,6460187935949786489,9190322025463579146,262144 --variations-seed-version --mojo-platform-channel-handle=5956 /prefetch:8
  2⤵
  PID:3824
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --always-read-main-dll --metrics-shmem-handle=6220,i,15258917916330612612,17342843398510093838,2097152 --field-trial-handle=2288,i,6460187935949786489,9190322025463579146,262144 --variations-seed-version --mojo-platform-channel-handle=6224 /prefetch:1
  2⤵
  PID:4300
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6472,i,3985781431694495030,17851971194037432895,524288 --field-trial-handle=2288,i,6460187935949786489,9190322025463579146,262144 --variations-seed-version --mojo-platform-channel-handle=6488 /prefetch:8
  2⤵
  PID:1192
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4752,i,15884232474127166776,4934270536229920058,524288 --field-trial-handle=2288,i,6460187935949786489,9190322025463579146,262144 --variations-seed-version --mojo-platform-channel-handle=4812 /prefetch:8
  2⤵
  PID:1064
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4816,i,8807342284175420503,12109953930366263743,524288 --field-trial-handle=2288,i,6460187935949786489,9190322025463579146,262144 --variations-seed-version --mojo-platform-channel-handle=560 /prefetch:8
  2⤵
  PID:3392
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4800,i,14309772578033973702,5042106816096379406,524288 --field-trial-handle=2288,i,6460187935949786489,9190322025463579146,262144 --variations-seed-version --mojo-platform-channel-handle=6496 /prefetch:8
  2⤵
  PID:2536
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5408,i,2545422565372861587,4910202417211957688,524288 --field-trial-handle=2288,i,6460187935949786489,9190322025463579146,262144 --variations-seed-version --mojo-platform-channel-handle=5368 /prefetch:8
  2⤵
  PID:5996
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5788,i,5664057439729689893,5632220276363238173,524288 --field-trial-handle=2288,i,6460187935949786489,9190322025463579146,262144 --variations-seed-version --mojo-platform-channel-handle=5820 /prefetch:8
  2⤵
  PID:5160
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=5224,i,4653106344790777823,4331201258997010773,262144 --field-trial-handle=2288,i,6460187935949786489,9190322025463579146,262144 --variations-seed-version --mojo-platform-channel-handle=5196 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2540

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:2252

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

CrashpadMetrics-active.pma

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\CrashpadMetrics-active.pma
Size 16KB
SHA256 814d47aad78c212b52568b9c7b58d242899d490d3afebce66181cae50c880df5
MD5 8c7cdfea4284ba987d295d82a9c7ddd6
SHA1 7d1a3a66f2d64a383b230196ba89a263ce7ee957
SHA512 59c8229e834c944265aed4131c79f41f9f940a48651b9fb18800cef5bae36d17c7fd5880120c6fee8ce22a157b65bc63846b65765bc4dc86e15926dcce400d0d
SSDEEP 12:sf9iXhV0xoUZxCe+JKlkQuMRxCb8TXuYJ0IJpPK6BsyW1inPiz:U9iRqxoUZxWMk8xVTeYWI31BtXP
TLSH
T105724C85B34498FFC8835E7189BD27903774F6DF1F02866B6A6A760E2E271C84F44224
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 81240d13af4ca099e1358c75991e3fa5640dbb3aac72c2d98006f6159bf74aa0
MD5 96dd753cd2d8557b97ab2cd76f7fc6cf
SHA1 81697ccb13fb04a07bd47b552b3607597251f36d
SHA512 355c412a688a71b124e85c0527177b3f97efceb2a5553f8428e0913940daffd3bd176f5476b940c64eee52d543f0568112ac073984d9a64015adc15cbef552de
TLSH
T174D09224BA29A149E282007AA881EB565219DA95296B9622E620C44DBD2B925A3851C2
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 4bf0783d55eb083b4adaa03ed8b76a2bd35b0819c8ad2530a78e1b8d6856010b
MD5 7a50c2e276f05b686e8cb6c95b86650f
SHA1 bc892af04a9d6b1bee8047f67518d676df864301
SHA512 f1d02fd9f067323214d78de08172e1a78028eba76f4754436f4d77b849e8422865dcea22be13f21c36ac2c5807b393c1dffdb0a3217c3353a517a0467461a474
TLSH
T19BD022203A28A008E282003AA880EB020208CA80282BC322E220C00CAC2B820A3800C2
MD5 SHA1 SHA512 TLSH

Submit Download

730f5165-00f6-49f6-8dec-f8fed50a6e60.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\730f5165-00f6-49f6-8dec-f8fed50a6e60.tmp
Size 10KB
SHA256 683a045a14ee5eda21204fd72a0ba3906b15381e0c48114b13ee9574d24132ca
MD5 0dca2326ec1503a8362963ede3b7cfb0
SHA1 9b9bef87c7d26359cc1cd77c94726e393629ca2a
SHA512 25f7a99f5b54c4a08bc7e8d7ece9d2dcf68a1a403e8dd40529c23fb54c2e56d2bef82d7129eb3bae391c32493982ef179da4631717ea0a4e314f4d1e4717e380
SSDEEP 192:sxZ+RLkx/fDsbTJuIdpDMHks6+WN5RO/YCV7rQ3IgrJ:sxZ+ax/fDsbTJ/IHuG/Rs9
TLSH
T1F022A6526E38A97B8CCBD219BA25BF53D2F9503291D41E58EAFCD61C04E7ADD120780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000099

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000099
Size 566KB
SHA256 ed3c24ba5561ab443050cb4fcc57a9385302333d4b7bc71c0abd3e6258f5d96e
MD5 66ca6491ccad400470af2b8ca75c0185
SHA1 281ea3ca7fa0be3bc1ec36572e2c7ff3d4f9ed80
SHA512 c1272f8ae2bb14d0add3f7e01eee535dbcc45b6928c649a7261331af71e84c8d15e3b4005d292972307ae9370981b7aba11bdd5979c51718be2613ead8da948a
SSDEEP 12288:vJOi+KUi39q/ImEERDAPJi313LMLIUQMPdpH+LqLaS:v1JTQ/MWDAOiOgHVGS
TLSH
T1FFC423858BF204CCCD3A3939B38D9966452DF1931E5447CBB934E9FB62D022C6E8758E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 4KB
SHA256 835a9dee520a5a703d83f8be607ada6d60b66a2f0deb0f270fed6652b75a23c3
MD5 95f9c9d7726e5e04af4b5dc9572d9655
SHA1 4dcda242a6d483e7912631ab8ac89800db547ec1
SHA512 90603067bbb8df9fe502cacee3e6ce09cb4f924d81e93fb21bed84c2943814059a72bcf3d919ce62f85ea3ee422ec1432fb4b5cfbea69c29e52949f492116fd1
SSDEEP 48:TwWI9AsVck0UBxdXxlFWVIlfKKB0NB1VWDwIM7MQgldWg9VQ3ilA:SHck0UndBlGIlf90HqDwIzQgvWg0iW
TLSH
T11491F8388D860790EB9C263045EA69377476C2FBF1633E5E9F5D9DBC2112B2F3A26404
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 4KB
SHA256 7f8e7cee0022323dc6bc0a88c363a2f2460975e7a08d5943f8bac8214b06e5c8
MD5 8b55ac518c306fc293a39e65a68d4834
SHA1 09afeb6f6192aea7afc4117a2e8588c525df6215
SHA512 b84211b89d75ec5234d0fc96dec2ddbf0ae59df353add3ddd1a90ee5865f9da840adb52191ed785ed82883552897213cf9f65bb375c03c9c03ff73b41c7c7638
SSDEEP 96:DOZlPk0U7dplGZlAlfA05VDwIzQgvWDx9W:DOA0sdpsMlfdBT9vyu
TLSH
T1FC91F8388D824690EB9C263045EA68277476C2FBF1633E5E9F5D9DBC2112B6F2E15408
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index~RFe58f577.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe58f577.TMP
Size 3KB
SHA256 f034ad2e82921c26e2b8ddb2b6e0ac93206ee394c782c162601c4bc5faff871e
MD5 96fe63232a72406194f3153c63aba4b1
SHA1 707471c5186123b44f2abd1529efee896cd4c57c
SHA512 b77c3a7276f5869d813aed41caaa89f132da95ac57057a0a3d7ceb3a42e951d5fd5610b23d8c6997c26c9643d330154a0e9221ebdffe0db3c9306b3e5d851baa
TLSH
T1F271DA388E0646E0E79C2A3182DA41177036C3EBF6677E5EDDAD5DBC2511B2F7E25009
MD5 SHA1 SHA512 TLSH

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 aa10bf07b0d265bed28f2a475f3564d8ddb5e4d4ffee0ab6f3a0cc564907b631
MD5 807419ca9a4734feaf8d8563a003b048
SHA1 a723c7d60a65886ffa068711f1e900ccc85922a6
SHA512 f10d496ae75db5ba412bd9f17bf0c7da7632db92a3fabf7f24071e40f5759c6a875ad8f3a72bad149da58b3da3b816077df125d0d9f3544adba68c66353d206c
TLSH
T18DB01269E5507CFF074A83A41428B463C3FF0047421C8ABEEA3873AD42A21FE0828C57
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 1KB
SHA256 f3a7e0c57fc735b4ce8b2730563359a503f5dbf2d0f7732744580e99023329aa
MD5 0918f21a41752b2651f495ed493a15f1
SHA1 bdfc8349a9b506eb491cc0f9f750f08403e29d43
SHA512 fd4b4f4792b2e59ce373b843d19779753198ff3b2faedb50a6bd9d9e2d21b96421b75522ee68f547d98944a60c37c4f43188987b70cf6c92303e1ac6ca50021a
TLSH
T1FD316CF383F5956E8A2152F09A18AE2FCE6D0511832C7D79C5D8AE2793E3471E101E5B
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 10KB
SHA256 df766ad7b5cc037519640e6042c145a3225a26267bc6a55bd5a0711a768364c1
MD5 ca8446a9630e532835b09c7ca3102cea
SHA1 5562a1887ef64dbb8a8be991abafa51914546be4
SHA512 dac73a711cc70acd34d9495c4dfd208c11241ff55cb478aa21edbbd7e87be30731d4c5b02139448090b14f7a819d19d9c4caf6d707dcc116a3b7f41eb5354af8
SSDEEP 192:sxZ+RLkx/fDsfuT8uIdpDMHks6+WN5LMVYCHXrQ3Ig5CJ:sxZ+ax/fDsWT8/IHuKVvsc
TLSH
T19232B8526E38A9778CCBD21DBA25BF53D2F9503291D51E58EAFCD61C04E7ACD220780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 10KB
SHA256 f102c97822d4e87da2356c2f959951e6e85291c25d971620a9b321ebb72f8752
MD5 ad93f60cfa92a3c994e9ddfd74f75dfe
SHA1 3a385c924b1580343dca10ed1a7a00c7a20efd5f
SHA512 72ce985f4b4e775d04bc98f3745af0ade012928e4d02da918c3630743524dc54844708e4a72c7a04d237e4afb57eb537108c1762f99d9d054ad74a1ee99b0061
SSDEEP 192:sxZ+RLkx/fDsfuTJuIdpDMHks6+WN5RO/YCV7rQ3Ig5QJ:sxZ+ax/fDsWTJ/IHuG/Rsu
TLSH
T16B22A7526E38A97B8CCBD219BA25BF53D2F9503291D41E58EAFCD61C04E7ADD120780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 27KB
SHA256 bb5561b52971a77747f993473738a24eece9b7e77689fdb83b70e3a352a859be
MD5 fcaf50206bfa8c4edb72fa74eab4c135
SHA1 040bb727655d9f045c8d360b96caef10b822929c
SHA512 9ea088841380775f85f08f099a3938d8791af646da29d674eceefc03b8f5a119538e4e8ae9c4578d40c894e2395019e52558ebde4256474e20560295ec0370f6
SSDEEP 768:S6qbUj+WvSCU68F1+UoAYDCx9Tuqh0VfUC9xbog/OVHZLlRTKr2roR:S6qbUj+WvSCU6u1jaaZLbWrNR
TLSH
T152C2D83B240CCA7E4FC01A9DDD5A6F972EA802C7A7588D4447FA994C02C77EA512B4DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 3KB
SHA256 da20616568a417b43c434548a7203b7fa7417e355d26576edd02f7a2e9cca08f
MD5 9eba84861bb38bd698711e035640f180
SHA1 b2757fb9c828d26a10f317db2251bd69f0cededf
SHA512 3a8b8e5adc8334165252490a95e0a7c99fcd976eef721fa54330badb09df0f5b0ee09bf4179e74ea11afbb9b8efe8e3676ee48a41463a9fa9705decf58baee86
TLSH
T16D81FC457ABE42023CBF246DA56586370B8331A37054B87B7BA815730EA7E116CFE8D9
MD5 SHA1 SHA512 TLSH

Submit Download

favorites_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\favorites_diagnostic.log
Size 1KB
SHA256 58796411c2239b5b6782c2a3ed14ac833986695942dfb2ed399597ad6948b38b
MD5 5e8f36cd2ba90d255b13fe36daed542c
SHA1 28b9c0d4e5b55ea1ce0245f0a09df416aa03604d
SHA512 5331c48cc09c901a517dbb83615ba3d4b5f3bf2d1e3920fa5a371a179884d5a9f0e8747594bfc4f1d12f1e73320a85b7ca50bbfb4ccdee6efc03cf816f63f7a8
TLSH
T19B2144C09BEE1095AECBA56AC11D951351B23F77220E6933331E86F54FC49141E6F929
MD5 SHA1 SHA512 TLSH

Submit Download

OperationConfig

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig~RFe593c63.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig~RFe593c63.TMP
Size 3KB
SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
MD5 904e6e94a1d46374c8630cfd86cc729f
SHA1 e1d9c3f7813878acc6510d48d95b2bf48b2e1a0d
SHA512 081e2a26252860ff8d8f7a9d0378ae56f0cc50574d13d2a121afdf74284963747ef874a4d73b1df7774cd8570972f4f513eefe0a0325fd088556d5b1ba946712
TLSH
T1DB815C4FCC0CBE77ABAB6A719A35D6B2F79131EA94518A977F8C444EE3050ED0242E50
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 19KB
SHA256 ace4e6fff29a4fb936aa3e26256005a269a36a18151e08d343b91a2bf828b20f
MD5 4625f033de53f754e6f4a88b76b34a75
SHA1 d95c6b5bfd6e6e5a9f0909d789224f597f39062c
SHA512 36edc266a27c5cbdc0ea220df4365eca3f3867117f337cf4de9e7c0c860f165bc6a3010f223dbef74857ce6b8bd89105cf75020f7c4784dd1c2fdd7263f5d451
SSDEEP 384:CZcIhsNMtUK+Uj7RTMEa+XOkjTU6HlytEDq1zCUM:wh5U0jNXauOuTUoy6DqNM
TLSH
T1EB929E7159785C335EF7A185F48A3A179EF88037D6C86ED4A2DDAF1D00DA5AC130BC26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 27KB
SHA256 98ce8579a9e4208f224b73cdd780bfea1241f02938855fbd7c4fb3a106ca93cc
MD5 518c320f2595abcd8cee2ecbe1db18e1
SHA1 ab44f1bfe539c885707eec26728bf84c0095867e
SHA512 afb1938363d1aba1c684a2d9d15321b160031080c1065ef516e00b0962d0bf86d03b83ba709ec39be1c0cb21bd315eeb51a951fe6da9acce693b773c36ac2ae1
SSDEEP 384:ZiFiZcINzsNE8TUNTUlIl6UK+Uj7RIMEa+XOkjyU6HlytEDq1zCUM:wFQ1twgMU0j2XauOuyUoy6DqNM
TLSH
T14AD218F245E78936D9AE5747E77D2D138EBCC067B5846990B3C89A1CCC860BFD30A815
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 70a8a65a661c7f633aa5ee3d9173cfd4878dc5ad56ca52a737194dc75b10da69
MD5 787611cfa86e0622b207270868000915
SHA1 392c8ef26cebc541cc1be5d85ce57e4803a87c13
SHA512 3074df5c3cb23f7c952e957630fd91e80a3aa54b4bf79854f89fbe03f70f47a84566b28b9ca1de3bf87de9d149eca78645894e5f70af6959bd6ac1353520f196
SSDEEP 192:vONi6Db6QmiUyCiHBa+jLOmLtmVERgncU6:vONi6uWHBa+XOkUcU6
TLSH
T19302FA3569786CB79EB26E49F88737179F94207BD9562F84D6D81F1C00D764C2307826
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 20KB
SHA256 11731e8098ae4c82c7724f2a68232d0046e942d2752bfab1a3694d27a4074cad
MD5 b208feaf4096ff9c0c4f697a76b77713
SHA1 2fcd02573cd6319e00600394bdc6dab7b9655e94
SHA512 a013fe6c565b2720ba4e6b041cb60e398cbe10567f525634d0bf0ca3f2549a1cd4995a32a5a0798c235d3fc67eca6383d2aff2e5749266391d54684070dde3d9
SSDEEP 384:bZcIhsNM6UK+Uj7RTMEa+XOkjTU6HlytEDq1zCUM:DheU0jNXauOuTUoy6DqNM
TLSH
T14E929E7159785D3359FBA185F88A3A179EF88037D6C86ED4A2DDAF1D00CA5AC130BC26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 70d597acfc79fb8f178bd5a4c2fc6b6a1fb3625a1fd114a532e14369c718fb50
MD5 ac80cd2d885efc44febec3853c7279d3
SHA1 68ca0e541ff95e4a5a2a8b3d7ee7101959e3557e
SHA512 d2d7f23b4ef929c2a6f4bb947a80de586c9124cb2985370136027639af419a062184111e31ff69f1460093b1b769943ae9bd02f299b2f88aa349eb4385c705f3
SSDEEP 192:kONV6DbTQmiUyqicBa+jLOmLtmVyANzprqgqU6:kONV6dUcBa+XOkjgUU6
TLSH
T128122A3679789C775DE2A594F48736139EE85027DA8A7F94D6DC2F0C00DB65C230BC26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

611bb6e1-32b4-45a4-a74d-4ec48a144fc2.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\611bb6e1-32b4-45a4-a74d-4ec48a144fc2.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 f6e84bc0ec6e5c84d0cd936d5713db613766fdb0ea31681315c646a84d23bb9c
MD5 7653c4271f6c47016ea891cb45f80f5c
SHA1 3d679517c4158453158b1b8d7de51f51491d43ae
SHA512 101efa0a41ec9f040f81c945298275248b9406be4f870ace094a829581420eb0e403e6321f03d8bdba5d91c99aeceb3cf5b2c3c6c48637e2359b7a9fad2e5af3
TLSH
T1D1410B58BAEA1148B3777F5A5BF6A8AE447E79372E0AE54D00110E4F0923B44C971B37
MD5 SHA1 SHA512 TLSH

Submit Download