29e5e2228e53b28cfa5e0b53ca0a5e0819ce44349283e87c59f0ba02522f59f1

Analysis

max time kernel
148s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
13/08/2026, 18:13

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
CheckNew.html
Size 1KB
Sample260813-wt8svadn2w
SHA256 29e5e2228e53b28cfa5e0b53ca0a5e0819ce44349283e87c59f0ba02522f59f1
MD5 bcd41a2ea5801f47dc03936723259e07
SHA1 f46acc833fde74b0a2e1293a4a57af0ceb63dda9
SHA512 2ef3fa2d245ab6d87df5a0a75fe56310c1b73798d1c4100dbac26cc074092c1d86f6c6cf820195409f5ed3e4d799468fbc528fdd0f75d2ceb1dfd86c53067914
TLSH
T18741326A9E94A0BEC2612CE88CFDA548B17A06502404E43CEDEC919455E0F5D582FEFC
MD5 SHA1 SHA512 TLSH

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
312	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134311185395458553"	msedge.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-668679576-120646659-2289335452-1000\{2E80EEB5-09D8-4DF7-B2E5-DA7751F2ED0A}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4368	msedge.exe
4368	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
2196	msedge.exe
2196	msedge.exe
2196	msedge.exe
2196	msedge.exe
2196	msedge.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
2196	msedge.exe
2196	msedge.exe
2196	msedge.exe
2196	msedge.exe
2196	msedge.exe
2196	msedge.exe
2196	msedge.exe
2196	msedge.exe
2196	msedge.exe
2196	msedge.exe
2196	msedge.exe
2196	msedge.exe
2196	msedge.exe
2196	msedge.exe
2196	msedge.exe
2196	msedge.exe
2196	msedge.exe
2196	msedge.exe
2196	msedge.exe
2196	msedge.exe
2196	msedge.exe
2196	msedge.exe
2196	msedge.exe
2196	msedge.exe
2196	msedge.exe
2196	msedge.exe
2196	msedge.exe
2196	msedge.exe
2196	msedge.exe
2196	msedge.exe
2196	msedge.exe
2196	msedge.exe
2196	msedge.exe
2196	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
2196	msedge.exe
2196	msedge.exe
2196	msedge.exe
2196	msedge.exe
2196	msedge.exe
2196	msedge.exe
2196	msedge.exe
2196	msedge.exe
2196	msedge.exe
2196	msedge.exe
2196	msedge.exe
2196	msedge.exe
2196	msedge.exe
2196	msedge.exe
2196	msedge.exe
2196	msedge.exe
2196	msedge.exe
2196	msedge.exe
2196	msedge.exe
2196	msedge.exe
2196	msedge.exe
2196	msedge.exe
2196	msedge.exe
2196	msedge.exe
2196	msedge.exe
2196	msedge.exe
2196	msedge.exe
2196	msedge.exe
2196	msedge.exe
2196	msedge.exe
2196	msedge.exe
2196	msedge.exe

Suspicious use of WriteProcessMemory 30 IoCs

description	pid	Process	procid_target
PID 2196 wrote to memory of 728	2196	msedge.exe	86
PID 2196 wrote to memory of 312	2196	msedge.exe	87
PID 2196 wrote to memory of 3896	2196	msedge.exe	88
PID 2196 wrote to memory of 3896	2196	msedge.exe	88
PID 2196 wrote to memory of 3896	2196	msedge.exe	88
PID 2196 wrote to memory of 4428	2196	msedge.exe	89
PID 2196 wrote to memory of 4428	2196	msedge.exe	89
PID 2196 wrote to memory of 3032	2196	msedge.exe	91
PID 2196 wrote to memory of 3032	2196	msedge.exe	91
PID 2196 wrote to memory of 4268	2196	msedge.exe	92
PID 2196 wrote to memory of 3032	2196	msedge.exe	91
PID 2196 wrote to memory of 4268	2196	msedge.exe	92
PID 2196 wrote to memory of 4268	2196	msedge.exe	92
PID 2196 wrote to memory of 1792	2196	msedge.exe	93
PID 2196 wrote to memory of 1792	2196	msedge.exe	93
PID 2196 wrote to memory of 1792	2196	msedge.exe	93
PID 2196 wrote to memory of 8	2196	msedge.exe	94
PID 2196 wrote to memory of 8	2196	msedge.exe	94
PID 2196 wrote to memory of 8	2196	msedge.exe	94
PID 2196 wrote to memory of 2360	2196	msedge.exe	98
PID 2196 wrote to memory of 3360	2196	msedge.exe	99
PID 2196 wrote to memory of 2360	2196	msedge.exe	98
PID 2196 wrote to memory of 3360	2196	msedge.exe	99
PID 2196 wrote to memory of 2080	2196	msedge.exe	101
PID 2196 wrote to memory of 5024	2196	msedge.exe	105
PID 2196 wrote to memory of 4804	2196	msedge.exe	106
PID 2196 wrote to memory of 2588	2196	msedge.exe	107
PID 2196 wrote to memory of 3032	2196	msedge.exe	108
PID 2196 wrote to memory of 3032	2196	msedge.exe	108
PID 2196 wrote to memory of 4368	2196	msedge.exe	115

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument C:\Users\Admin\AppData\Local\Temp\CheckNew.html
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2196
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x254,0x7ffb20eec188,0x7ffb20eec194,0x7ffb20eec1a0
  2⤵
  PID:728
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1976,i,14917217498924076065,16809118141161209095,524288 --field-trial-handle=2068,i,4956528245890138083,9775722997400255084,262144 --variations-seed-version --mojo-platform-channel-handle=2196 /prefetch:3
  2⤵
  - System Time Discovery
  PID:312
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1644,i,8041605687972643501,12079292133419967505,262144 --field-trial-handle=2068,i,4956528245890138083,9775722997400255084,262144 --variations-seed-version --mojo-platform-channel-handle=2072 /prefetch:2
  2⤵
  PID:3896
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2384,i,2214057254046394964,14551367779495620732,524288 --field-trial-handle=2068,i,4956528245890138083,9775722997400255084,262144 --variations-seed-version --mojo-platform-channel-handle=2648 /prefetch:8
  2⤵
  PID:4428
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3432,i,9285190508613798426,230058674945155811,2097152 --field-trial-handle=2068,i,4956528245890138083,9775722997400255084,262144 --variations-seed-version --mojo-platform-channel-handle=3496 /prefetch:1
  2⤵
  PID:3032
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3436,i,11943693406080879135,5862728383174371392,2097152 --field-trial-handle=2068,i,4956528245890138083,9775722997400255084,262144 --variations-seed-version --mojo-platform-channel-handle=3500 /prefetch:1
  2⤵
  PID:4268
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4232,i,7861863833457289409,3667875986024128725,2097152 --field-trial-handle=2068,i,4956528245890138083,9775722997400255084,262144 --variations-seed-version --mojo-platform-channel-handle=4280 /prefetch:1
  2⤵
  PID:1792
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4256,i,16913563203940769673,8048475679328118459,2097152 --field-trial-handle=2068,i,4956528245890138083,9775722997400255084,262144 --variations-seed-version --mojo-platform-channel-handle=4308 /prefetch:2
  2⤵
  PID:8
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5088,i,2370312413923132530,8006385411622254542,524288 --field-trial-handle=2068,i,4956528245890138083,9775722997400255084,262144 --variations-seed-version --mojo-platform-channel-handle=5192 /prefetch:8
  2⤵
  PID:2360
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5132,i,11597673182938399707,13047395737514164157,524288 --field-trial-handle=2068,i,4956528245890138083,9775722997400255084,262144 --variations-seed-version --mojo-platform-channel-handle=5212 /prefetch:8
  2⤵
  PID:3360
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5852,i,5998157889252676161,8638208606375106886,524288 --field-trial-handle=2068,i,4956528245890138083,9775722997400255084,262144 --variations-seed-version --mojo-platform-channel-handle=5832 /prefetch:8
  2⤵
  PID:2000
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5852,i,5998157889252676161,8638208606375106886,524288 --field-trial-handle=2068,i,4956528245890138083,9775722997400255084,262144 --variations-seed-version --mojo-platform-channel-handle=5832 /prefetch:8
  2⤵
  PID:2080
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6304,i,3564105775233693951,7482179887559961474,524288 --field-trial-handle=2068,i,4956528245890138083,9775722997400255084,262144 --variations-seed-version --mojo-platform-channel-handle=3640 /prefetch:8
  2⤵
  PID:5024
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6288,i,12697774818704498361,1920001320755399551,524288 --field-trial-handle=2068,i,4956528245890138083,9775722997400255084,262144 --variations-seed-version --mojo-platform-channel-handle=6300 /prefetch:8
  2⤵
  PID:4804
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6308,i,14146914093959832771,1790567302458138052,524288 --field-trial-handle=2068,i,4956528245890138083,9775722997400255084,262144 --variations-seed-version --mojo-platform-channel-handle=4496 /prefetch:8
  2⤵
  PID:2588
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5216,i,10152784860130298915,12988847876723307787,524288 --field-trial-handle=2068,i,4956528245890138083,9775722997400255084,262144 --variations-seed-version --mojo-platform-channel-handle=2952 /prefetch:8
  2⤵
  PID:3032
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6068,i,625744319702945254,11601073175439332005,262144 --field-trial-handle=2068,i,4956528245890138083,9775722997400255084,262144 --variations-seed-version --mojo-platform-channel-handle=748 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4368

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:4248

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

6f931cde-c8ac-4b08-b769-20ec5fb3df64.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\6f931cde-c8ac-4b08-b769-20ec5fb3df64.tmp
Size 11KB
SHA256 fa2cf06cd25b39ea648d5766da2678f11cd756daf8c932b727cfc22162723f16
MD5 e775ef31cd88701269e6281b19ea3c65
SHA1 8b58dd7e8f9d9fb228c589e0fb4ca063485e5a48
SHA512 6ef44ba768d97deb6b322098fc1ff27021b0a4cc4896ae536c52ef51fce45968dcef57e3ded088dd13e10db85a29d267bb53ff46d39c06914da8b5888b95a636
SSDEEP 192:uPLsNGT6QS4I+wbiERQmiU1WnG4Ea+j2+FdCrtmEpe4G8amGqcU8:isNm6FYieJEa+ld8fIU8
TLSH
T1A1321B3568786C7B4EE2B545F4473A13AFB881678AC92F90D6DD5F0C01DB69C130B826
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

blocklist

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\blocklist
Size 105KB
SHA256 a2c61bea42f4792ccf2dea08f14f81a078364fa04174865bd5fe47f501381f05
MD5 09fbdba77ec7c601967b67ba7843ac9d
SHA1 224acea2cce8b12dc63a4f7d4b68711314212956
SHA512 9682cfb20b9727c724e2f6c18b20015553a95fc07e89c07b0ae43561245b3ffa4b5430d5d101bcbf755b4df7ebb66db49219ad0b21ee8af6925d9223ece58841
SSDEEP 1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P76:fwUQC5VwBIiElEd2K57P76
TLSH
T1A4B3B931457E36BF26E93EE828CF1511B84F3912664895D4ABE1FE2C4845E68633CEF4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CrashpadMetrics-active.pma

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\CrashpadMetrics-active.pma
Size 16KB
SHA256 814d47aad78c212b52568b9c7b58d242899d490d3afebce66181cae50c880df5
MD5 8c7cdfea4284ba987d295d82a9c7ddd6
SHA1 7d1a3a66f2d64a383b230196ba89a263ce7ee957
SHA512 59c8229e834c944265aed4131c79f41f9f940a48651b9fb18800cef5bae36d17c7fd5880120c6fee8ce22a157b65bc63846b65765bc4dc86e15926dcce400d0d
SSDEEP 12:sf9iXhV0xoUZxCe+JKlkQuMRxCb8TXuYJ0IJpPK6BsyW1inPiz:U9iRqxoUZxWMk8xVTeYWI31BtXP
TLSH
T105724C85B34498FFC8835E7189BD27903774F6DF1F02866B6A6A760E2E271C84F44224
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 1c8e6fcbb66aba64fe595f222fc4117e00e82ccdc0eef2100a1b4f7babb04f87
MD5 398d1e7948d46a763209c466fdacd0fb
SHA1 b26f2c32bc106089a59ce779d792beaba59f92bf
SHA512 a0bbf31d803e7333d004f03de9c261732d00cceb5d82dd64b5f0decf8adc8b840891187c72bb21cce83873e6d4dd2fab89d4c7efa320afe2ef3589678dcb1424
TLSH
T1B6D080277A196004F3964175A483D7061319956129575711F310C44CA9775D553C11C2
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 5d2c4e39ddbeb0ac61628bae04f1ac5787600ec893b0e230d1a84d61470771a9
MD5 cd6e704306442404371caebfec7f5b29
SHA1 e4beab8b7820af3633bf7c75a5498a958a95832e
SHA512 de66681a9245e8ece7d7e2ea2080251c395f2aeb8a885ac007eaf16f2ee3a3e36610d2afc17be964a038704371cedfbe4da91143ebed5adac20dbda97768d6e6
TLSH
T13AD080273A196404F7964175A483D7061319956129579712F310C44C99775D553C11C2
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 fe26c7980fe968a2ad06d320e64cfe291121412c844ae1ea9c9038314bd36edb
MD5 8bc0bfb8f331fce5ed03dba634593f68
SHA1 7b15a3fe8e00f7b2dfdd3a1ddb28f3c2d151e792
SHA512 8cc0e448f272b110ad9627aa96ea487f11d03aeb0d0af702f74eb1c47cd8ba2ac63d51a91597284e7fef2d67880e199cf1eaeef82750ae0d6566491e90e8f464
TLSH
T17E8172370282A6C0D3A0173990D28224367082DBFF6F5F7D3B9459F12B767150E19DC8
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5862fb.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe5862fb.TMP
Size 3KB
SHA256 a7b25bbde9c550471ba5d51aece9d153023ef0d7688aa0d5ec0a20f87dbf46ba
MD5 6b345e7f546ab8a8dbaed92750311dd4
SHA1 6c616c8aaf9f3e185584517e6a4a8c78163b8d3f
SHA512 0e03add4ac824a5454782c9d598814070b24d8730c3fab5ee93b7c751cd894b3dbaf683273edc1db9e8c167bc80733915b9371dffd9dd69412d1d81120117cbb
TLSH
T1598161370282A6C0D3A4273990E68224367086EBFF6F5F7D3B9459F12B767250E19DD8
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 949B
SHA256 22aa4fad264cfee041cf1b61f66199f57529f10ca2c4ebf576f0e304546d41b4
MD5 2a72aeea63363e649fd77856c95eb190
SHA1 29b6b94ce600e0c5078579d8bb0effbee4232b43
SHA512 0655ff0523d6f9f0ac36061697632cb42aee9a42ba9649b538ea773da01a4a70e27b5b6fd06089cf9ef15cebd8061fb6749bfeb44f2947f76c607bbc97a26b20
TLSH
T13C117DF3C3E5856E8A0156F05A24AE2BCE2D0516421C7D19D9D4EF2793E3075E00255B
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 d45be55f416d7f5a0a249f41ee3f9f267e51982db73ff84648a8e83452f80018
MD5 737037f57c203372e086ae96b36e82b4
SHA1 e0cab765e041f8ff852d79d5b8aa10d2d94ec65d
SHA512 8836dd17a5b0c0867c9ef83e5a6a39f9da151fba31c20012188007ccae1c0611f3b66169a861d5db895bc95201443bb915208d978bb975fa2276adf8baa9ba57
SSDEEP 192:sxZ9RryM/jK1Ml8MkK/fcsWWWMdIdpdmHW6+WNGYCk5QymIgrJ:sxZ9BMK/fcsdWzgHbGHR9
TLSH
T16842F7116A34A977CCCBD209FA557F53D6F90473A2940E44AAFCDA1C05E6AEC221782F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 a4d3277e8c007df6619efb30f94d18b8a5be4d1f5a847fb0167f864653bccec9
MD5 1ebf49399d2844f673e1b17e2aab06e7
SHA1 8d7257a8bbc274defe658c3a1b7855cad996da56
SHA512 fa017852ce728d802f38f8481c7edc64c8c7942af31daebf1631ac82b6e9477978e85e77e873d518d6260338c2656bef092a3d0ce302c71c8c9e62ea7eeb50e5
SSDEEP 192:sxZ9RryM/jK1Ml8UQjkK/fcsdWZMdIdpHmHW6+WNGYCE6HymIg5MJ:sxZ9BqIK/fcscZzGHbGhRS
TLSH
T10352F8156A349977CCDBE209FA417F53E6F8047392940E44AAFCDA1C05E6EEC221782F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 30KB
SHA256 818a73c6befac5bbe371735f92a212deb0678526580f0c8b5d6894afd592c999
MD5 213b98ace7b4eea6d62d592cf5ca1ccb
SHA1 0b76f611abc59267db25dd103dd9cb5a0fe94e7a
SHA512 15eeff1372c59f1573cdfd329254dca0b8450ce70b08e1ad191d02cd9ed94639eb25156b72533bf7e2da2224528da184aa4cbef09bd64510afaf5355c48f4730
SSDEEP 768:ha8bqn+WvSCt68F1+UoAYDCx9Tuqh0VfUC9xbog/OVnZLlRTKVCrooA:ha8bqn+WvSCt6u1jaCZLbWVZ9
TLSH
T1A7D20A3B280CCB7E4F845E5DEC26AF962DD801CB6B988D4447FA894C03C76EA511B5DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 5KB
SHA256 cfa2b34c05a83263e2fd831d72627a7bb5890cfe59a84b1fb3080119d519aa6c
MD5 e9b5873ee1c579383a9a9b76279a48b5
SHA1 0bd522561cdaa37a5ea91f16095526f85ca521ca
SHA512 22d3ce0d6a133a3750d7215a7b5871627bf0b6cf22ec4e8d03751e216975ffc2548866005ddb6b12cce5406c01de09dec9c6309bb1ca5b5af6b505f8d62ad694
SSDEEP 48:KoXIpK0g0bypQIHKpOXwI/K92c7yfa/Q0CkQzPg9CI4szKpqBOzVqj+lYl:KoX6K0gCKQoKpOXwgK92SWXOKo4c
TLSH
T131B1F402303F124638BE2528A3B6963BCD4172673915ACBF3B7920628D66E514DBDCFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 11KB
SHA256 c071e29640846aa6834c3551563242b904c86df6d5e7958fbdf6995ce76d2d30
MD5 cf2f59b4aa7513ca384536987f3544f3
SHA1 c66650296f7e77ef73532b85b4ba79350ba29362
SHA512 c64346a046437c7bf3026f67f52c05ff146bc5805db46482bdaf5fe269a856e446ae8d30b2d0f6d726b229d5fb8f0112bbe1a78eee58ae120048bbb3aecb4d04
SSDEEP 192:wLsNGT6QS4I+wbiERQmiU1WnG4Ea+j2+FdCrtmEpe4G8amGqcU8:GsNm6FYieJEa+ld8fIU8
TLSH
T138321B3568786C7B4EE2B545F4873A13AFB841678AC93F94D6DD5F0C01DB69C130B82A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 20KB
SHA256 5e2638d6758c65086cd10cbfb48dc1562da058a79d2f18fbcd1662b34100a82f
MD5 42c0dacb97608d7e5dbb9153ee79cb22
SHA1 ae7a75c5741377416e1ac05b8d98014dce5ee6e9
SHA512 0e0f469b087b621a8905eef8e4cf0487066d0c0e1b4698fd3c2575a51adf03b734e25ac94c1fb30473d777ec039b3f493cefd678f9ecefebcec02b59987f4d09
SSDEEP 384:6ZcIhsNmuFYieJEa+ld8fIOOPrXLpe8C/x:4hA0Ca8cIOi9Pq
TLSH
T173928E3168785D675DF6F685F4873A07AFF89063EAC92F84A6DDDB0C01DA9980307C26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 2ae66ae29c5638e0a772cd1a4e07b04c272a7f23899d02dd4eb444750f85b4ee
MD5 c2b9fd90ded65e94f025743e5e86bb4b
SHA1 5d0ba10ffb4340e392e9c4208b8867400bcc97ed
SHA512 38d9c1ff09c1d575fdb8695d25e56ed6acd509f75d3791b142b340a6e7c4e85bed1b420e3578ed79e30d7d16ca96faf699d0e801313eab472ec8856d0eb41b84
SSDEEP 192:vON3p6Db6QmiUy2qHBa+j2+FdCrtm5Rg6JWU6:vON56uuHBa+ld85CWU6
TLSH
T18702D93568786CBB9EB26E49F4873B179FD4206B99962F84DAD85F0C00D765C1307826
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 90a802ec65272b875dc4444a72c6e3810ce46be479a3437500afdfdeb1ec4a23
MD5 f6ceaf926c6b5ba1ff5ac25d7de6d626
SHA1 bfcf4128e019d2a8debc9571584908d9a95a1a7e
SHA512 7934761578e7179612db6fda17e612d228f57eb6d9a1cdf0b9c5613c62a1285c37a1f9db22242e37dd74314edd5fc9602b5762be82125c828b1bea78d558fa10
SSDEEP 192:XONqS6Db3QmiUyhqrBa+j2+FdCrtmEpe4GGNzGqcU6:XON36RjrBa+ld8jIU6
TLSH
T14B121C3268785C6B5EE2A545F4873617AFE49167DE8E3F81E6DC1F0C00DBA9C130B826
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 22KB
SHA256 4aca4364fbc7cd60ccb7bb6e061a8070470bc71f8ff35c5f5fb5e1b4311ffeae
MD5 030c7b6f7017f5a2254f8c586d57917d
SHA1 9304f127a1b4065e07a20fe0f78cff32a74d4818
SHA512 c6d7638f85609c30ea812398b0d45a3ce7ca9d7ada8ddcfcd2fba534bab512bbf70b7fd266538f3472d8faa477683b6349933384ee21a290f10d93bbaef72ffe
SSDEEP 384:NFiZcI8sNm8TUNTUlIltFYieJEa+ld8mIOOPrXLpe8C/x:NFQ8nwgN0Ca87IOi9Pq
TLSH
T15AA26D3258B8996BADF6EB85F48636079FF880A3D9D56A94E7DCCF0C01D6598030BC25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\metadata.json
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 d0c010fb102e928ce05317d25732257da4d10f702ebce9dedc96382153323eed
MD5 2bf4fafa3c4193fccfb5a6299b1a14e4
SHA1 a7c978faba71c56ef62ffd77fd4fb346fc6e1800
SHA512 c25860130895e106879957442aedba9a19f87aeb4ac3e474c21ea2bd1887041f28ef066e970aaed21d85c9942ce97502542f2bfc3acee2854a159216fb6788f0
TLSH
T145413F697BE91118B3B37F1AABF6B8AD487F78376E07D45E00110D4E0662A41CC61B37
MD5 SHA1 SHA512 TLSH

Submit Download