hxxps://portal[.]etiqa[.]com[.]ph

Analysis

user interaction
yes
max time kernel
149s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
14/08/2026, 23:16

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://portal.etiqa.com.ph
Sample260814-285ydsteja

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
3288	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134312229837506431"	msedge.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-668679576-120646659-2289335452-1000\{FB90F071-1440-4EE5-9E6D-60B276CE1503}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2468	msedge.exe
2468	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
3188	msedge.exe
3188	msedge.exe
3188	msedge.exe
3188	msedge.exe
3188	msedge.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
3188	msedge.exe
3188	msedge.exe
3188	msedge.exe
3188	msedge.exe
3188	msedge.exe
3188	msedge.exe
3188	msedge.exe
3188	msedge.exe
3188	msedge.exe
3188	msedge.exe
3188	msedge.exe
3188	msedge.exe
3188	msedge.exe
3188	msedge.exe
3188	msedge.exe
3188	msedge.exe
3188	msedge.exe
3188	msedge.exe
3188	msedge.exe
3188	msedge.exe
3188	msedge.exe
3188	msedge.exe
3188	msedge.exe
3188	msedge.exe
3188	msedge.exe
3188	msedge.exe
3188	msedge.exe
3188	msedge.exe
3188	msedge.exe
3188	msedge.exe
3188	msedge.exe
3188	msedge.exe
3188	msedge.exe
3188	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
3188	msedge.exe
3188	msedge.exe
3188	msedge.exe
3188	msedge.exe
3188	msedge.exe
3188	msedge.exe
3188	msedge.exe
3188	msedge.exe
3188	msedge.exe
3188	msedge.exe
3188	msedge.exe
3188	msedge.exe
3188	msedge.exe
3188	msedge.exe
3188	msedge.exe
3188	msedge.exe
3188	msedge.exe
3188	msedge.exe
3188	msedge.exe
3188	msedge.exe
3188	msedge.exe
3188	msedge.exe
3188	msedge.exe
3188	msedge.exe
3188	msedge.exe
3188	msedge.exe
3188	msedge.exe
3188	msedge.exe
3188	msedge.exe
3188	msedge.exe
3188	msedge.exe
3188	msedge.exe

Suspicious use of WriteProcessMemory 34 IoCs

description	pid	Process	procid_target
PID 3188 wrote to memory of 2228	3188	msedge.exe	85
PID 3188 wrote to memory of 3288	3188	msedge.exe	86
PID 3188 wrote to memory of 2184	3188	msedge.exe	87
PID 3188 wrote to memory of 2184	3188	msedge.exe	87
PID 3188 wrote to memory of 2184	3188	msedge.exe	87
PID 3188 wrote to memory of 2172	3188	msedge.exe	89
PID 3188 wrote to memory of 2172	3188	msedge.exe	89
PID 3188 wrote to memory of 4236	3188	msedge.exe	90
PID 3188 wrote to memory of 4236	3188	msedge.exe	90
PID 3188 wrote to memory of 4236	3188	msedge.exe	90
PID 3188 wrote to memory of 4592	3188	msedge.exe	91
PID 3188 wrote to memory of 4592	3188	msedge.exe	91
PID 3188 wrote to memory of 4592	3188	msedge.exe	91
PID 3188 wrote to memory of 2636	3188	msedge.exe	92
PID 3188 wrote to memory of 2636	3188	msedge.exe	92
PID 3188 wrote to memory of 2636	3188	msedge.exe	92
PID 3188 wrote to memory of 2544	3188	msedge.exe	93
PID 3188 wrote to memory of 2544	3188	msedge.exe	93
PID 3188 wrote to memory of 2544	3188	msedge.exe	93
PID 3188 wrote to memory of 4976	3188	msedge.exe	97
PID 3188 wrote to memory of 4976	3188	msedge.exe	97
PID 3188 wrote to memory of 4388	3188	msedge.exe	98
PID 3188 wrote to memory of 4388	3188	msedge.exe	98
PID 3188 wrote to memory of 848	3188	msedge.exe	101
PID 3188 wrote to memory of 964	3188	msedge.exe	111
PID 3188 wrote to memory of 4684	3188	msedge.exe	112
PID 3188 wrote to memory of 4816	3188	msedge.exe	113
PID 3188 wrote to memory of 1212	3188	msedge.exe	115
PID 3188 wrote to memory of 1212	3188	msedge.exe	115
PID 3188 wrote to memory of 2160	3188	msedge.exe	116
PID 3188 wrote to memory of 2160	3188	msedge.exe	116
PID 3188 wrote to memory of 1872	3188	msedge.exe	117
PID 3188 wrote to memory of 1872	3188	msedge.exe	117
PID 3188 wrote to memory of 2468	3188	msedge.exe	118

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://portal.etiqa.com.ph
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3188
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x254,0x7ff9b409c188,0x7ff9b409c194,0x7ff9b409c1a0
  2⤵
  PID:2228
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1880,i,3082607557982953959,8079089704004189813,524288 --field-trial-handle=2272,i,7629835748890907463,16508770521416742856,262144 --variations-seed-version --mojo-platform-channel-handle=2300 /prefetch:3
  2⤵
  - System Time Discovery
  PID:3288
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1676,i,5787774919222684488,2349698997117080736,262144 --field-trial-handle=2272,i,7629835748890907463,16508770521416742856,262144 --variations-seed-version --mojo-platform-channel-handle=2268 /prefetch:2
  2⤵
  PID:2184
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2512,i,16507093753195370760,14093542085077055056,524288 --field-trial-handle=2272,i,7629835748890907463,16508770521416742856,262144 --variations-seed-version --mojo-platform-channel-handle=3020 /prefetch:8
  2⤵
  PID:2172
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3472,i,524023860513075,15495867814401190542,2097152 --field-trial-handle=2272,i,7629835748890907463,16508770521416742856,262144 --variations-seed-version --mojo-platform-channel-handle=3524 /prefetch:1
  2⤵
  PID:4236
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3468,i,2101571281020448044,2963744483473505336,2097152 --field-trial-handle=2272,i,7629835748890907463,16508770521416742856,262144 --variations-seed-version --mojo-platform-channel-handle=3520 /prefetch:1
  2⤵
  PID:4592
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4192,i,9100525582051365080,15630516517827568157,2097152 --field-trial-handle=2272,i,7629835748890907463,16508770521416742856,262144 --variations-seed-version --mojo-platform-channel-handle=4216 /prefetch:1
  2⤵
  PID:2636
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4236,i,1392476686936693085,9083962977224033361,2097152 --field-trial-handle=2272,i,7629835748890907463,16508770521416742856,262144 --variations-seed-version --mojo-platform-channel-handle=4260 /prefetch:2
  2⤵
  PID:2544
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3920,i,7727608387924160704,4435428117862740930,524288 --field-trial-handle=2272,i,7629835748890907463,16508770521416742856,262144 --variations-seed-version --mojo-platform-channel-handle=5160 /prefetch:8
  2⤵
  PID:4976
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5128,i,9209217859613170450,2785168696607284412,524288 --field-trial-handle=2272,i,7629835748890907463,16508770521416742856,262144 --variations-seed-version --mojo-platform-channel-handle=5188 /prefetch:8
  2⤵
  PID:4388
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5552,i,8485814879814034718,16999962246533077811,524288 --field-trial-handle=2272,i,7629835748890907463,16508770521416742856,262144 --variations-seed-version --mojo-platform-channel-handle=5572 /prefetch:8
  2⤵
  PID:4336
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5552,i,8485814879814034718,16999962246533077811,524288 --field-trial-handle=2272,i,7629835748890907463,16508770521416742856,262144 --variations-seed-version --mojo-platform-channel-handle=5572 /prefetch:8
  2⤵
  PID:848
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3532,i,16755933016452265435,5716496073535275058,524288 --field-trial-handle=2272,i,7629835748890907463,16508770521416742856,262144 --variations-seed-version --mojo-platform-channel-handle=6264 /prefetch:8
  2⤵
  PID:964
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4912,i,3008555898375236544,9246998628959400139,524288 --field-trial-handle=2272,i,7629835748890907463,16508770521416742856,262144 --variations-seed-version --mojo-platform-channel-handle=4996 /prefetch:8
  2⤵
  PID:4684
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5004,i,1151743475326890461,12567293662303339305,524288 --field-trial-handle=2272,i,7629835748890907463,16508770521416742856,262144 --variations-seed-version --mojo-platform-channel-handle=6288 /prefetch:8
  2⤵
  PID:4816
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4232,i,3777316210960728604,11097208786685507309,524288 --field-trial-handle=2272,i,7629835748890907463,16508770521416742856,262144 --variations-seed-version --mojo-platform-channel-handle=6428 /prefetch:8
  2⤵
  PID:1212
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5416,i,2574213114276059522,15649627346208048045,524288 --field-trial-handle=2272,i,7629835748890907463,16508770521416742856,262144 --variations-seed-version --mojo-platform-channel-handle=5880 /prefetch:8
  2⤵
  PID:2160
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5536,i,18104990415250580847,3556479718235169090,524288 --field-trial-handle=2272,i,7629835748890907463,16508770521416742856,262144 --variations-seed-version --mojo-platform-channel-handle=5172 /prefetch:8
  2⤵
  PID:1872
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6692,i,287149294108166175,15884627241923364242,262144 --field-trial-handle=2272,i,7629835748890907463,16508770521416742856,262144 --variations-seed-version --mojo-platform-channel-handle=5928 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2468

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:2620

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

CrashpadMetrics-active.pma

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\CrashpadMetrics-active.pma
Size 16KB
SHA256 814d47aad78c212b52568b9c7b58d242899d490d3afebce66181cae50c880df5
MD5 8c7cdfea4284ba987d295d82a9c7ddd6
SHA1 7d1a3a66f2d64a383b230196ba89a263ce7ee957
SHA512 59c8229e834c944265aed4131c79f41f9f940a48651b9fb18800cef5bae36d17c7fd5880120c6fee8ce22a157b65bc63846b65765bc4dc86e15926dcce400d0d
SSDEEP 12:sf9iXhV0xoUZxCe+JKlkQuMRxCb8TXuYJ0IJpPK6BsyW1inPiz:U9iRqxoUZxWMk8xVTeYWI31BtXP
TLSH
T105724C85B34498FFC8835E7189BD27903774F6DF1F02866B6A6A760E2E271C84F44224
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 81240d13af4ca099e1358c75991e3fa5640dbb3aac72c2d98006f6159bf74aa0
MD5 96dd753cd2d8557b97ab2cd76f7fc6cf
SHA1 81697ccb13fb04a07bd47b552b3607597251f36d
SHA512 355c412a688a71b124e85c0527177b3f97efceb2a5553f8428e0913940daffd3bd176f5476b940c64eee52d543f0568112ac073984d9a64015adc15cbef552de
TLSH
T174D09224BA29A149E282007AA881EB565219DA95296B9622E620C44DBD2B925A3851C2
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 4bf0783d55eb083b4adaa03ed8b76a2bd35b0819c8ad2530a78e1b8d6856010b
MD5 7a50c2e276f05b686e8cb6c95b86650f
SHA1 bc892af04a9d6b1bee8047f67518d676df864301
SHA512 f1d02fd9f067323214d78de08172e1a78028eba76f4754436f4d77b849e8422865dcea22be13f21c36ac2c5807b393c1dffdb0a3217c3353a517a0467461a474
TLSH
T19BD022203A28A008E282003AA880EB020208CA80282BC322E220C00CAC2B820A3800C2
MD5 SHA1 SHA512 TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\000003.log
Size 33B
SHA256 68c7ad234755b9edb06832a084d092660970c89a7305e0c47d327b6ac50dd898
MD5 f27314dd366903bbc6141eae524b0fde
SHA1 4714d4a11c53cf4258c3a0246b98e5f5a01fbc12
SHA512 07a0d529d9458de5e46385f2a9d77e0987567ba908b53ddb1f83d40d99a72e6b2e3586b9f79c2264a83422c4e7fc6559cac029a6f969f793f7407212bb3ecd51
MD5 SHA1 SHA512

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 291B
SHA256 230273e8fe58ceb886a36f9fb91147087cb261660253b9650e1afbac11157623
MD5 830aeeeeb47ffe35e39898efd2dbe92a
SHA1 753be4da94c355f723f6735f5cc8d073822dda77
SHA512 3a0d9a799b83d36bb6dcdbd5d8ea18f6e2c756a8f00f8eb6f25d6bcde46b0150a9f6ef66d621335f8b160119af64fecd78166339a6ad36627bd8bde20a4496f9
TLSH
T18FD0CD6585C1C62E964099DB5625971D81442A4F96C8BD0E6F44C44C3046589E697991
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 9b9c4ac6add0f3bae0ae0f34fdf32020e84edbbb1547286cfe226aab15b989d0
MD5 911331026a87622342b297b37ca46671
SHA1 f260ec72547f27dbf880af9636917c8428ae210a
SHA512 332777702e23f2bb4a3686243ce7678b4769754bd5cff578d72a602354ff2dae9a3944abb4e0980090ea52513e4c0214b06d57fd6b539467d2b772b0c177cb6c
TLSH
T1F161E63009E18B95E32133B183D2A5B0F4B41ED8F917EE862390B8790620B6FCF156E7
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe58d9c1.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe58d9c1.TMP
Size 3KB
SHA256 ee810098ea24f3b5ab4c5fa49bc822173185403c7bef13ba82e8f2dda596b2d4
MD5 309c97ceec9217f903aed4cf5c8555e2
SHA1 e357af9623caa7785c99f0a6f7eba53ca61e1ebc
SHA512 050363ce03f563ffd70887fd7deca73072146cd8039b3e5b550212fb39640eeed056f4d4e068d54ec2c1b314ad1fab27b6cd2c44cdef23e5644d1b3796521e9d
TLSH
T1F061D63409E14B95E31133B083D2A5B0F4641EE8F916EE862390B8794624B6FCF156E7
MD5 SHA1 SHA512 TLSH

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\EntityExtraction\EntityExtractionAssetStore.db\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\EntityExtraction\EntityExtractionAssetStore.db\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 1KB
SHA256 0cb6dfad57419415df664316c0b4cd3b61f740cbd0887c6966802914db024c88
MD5 159f0e1201efb9afe84efc2e6666c721
SHA1 deb303996bc92320da2506b3be0f6bf6f5c57939
SHA512 8a88830adc2c9fb227fc71c34613c657825203f4ed92a41ca39707b62872528c895cfdbd87accf6719e7278edda0b22eb7ac9a0aa4419da6334eab5fc4e2105b
TLSH
T11A21ACB3C3E5966DDD1126F05A14AE1BDE1D0A1582183C1AC9D4EF5B93F3435D10195F
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 10KB
SHA256 4e8c911ef0a0795b3d1913d7b8cd15a4154b4a9a9f7b4818c6ca961972e35de2
MD5 0de3adba801ec050b0e95985217466cc
SHA1 af4c1d82b1b9b072e0da95a77f89d097b4ade459
SHA512 b0d8a0bb185574c2a9e9503b6bd03ad606ecd93190fa7d1452028767fa07ac331c4ecd9bf65fc2ba6186b83cc978277218d6b10621213bf9ef8119417f5482df
SSDEEP 192:sxZ2R8kw/fasI1FIdpmjHW6+WNVrI/YCXGrS+KIg5PJ:sxZ2dw/fasI12MHbS/QSFb
TLSH
T1A022D7127E38A93B4CC7E21DBA15BF53E6F9507291951E98EAFC861C04E7ADD220740F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 10KB
SHA256 12bd7ba2aad88316570d2d5595a82d1e79de650ec29e46a6170bba528cb47fc4
MD5 c8755f1be55273c76e986ecf4e4a58b2
SHA1 e0a27df9c9a9d7cd9828742d891eae5ced5367e7
SHA512 0ec2efd731960279f98764f1197bfa42ca4fe147080a823bd98f9ca381318b44dee9dcddc75a587d667804f8674aa36770f7bd198c75f3c41dc05ad030e28c3b
SSDEEP 192:sxZ2R8kw/fasX1FIdpmjHW6+WNVrI/YCXGrS+KIgrJ:sxZ2dw/fasX12MHbS/QSF9
TLSH
T11822C7127E38A93B4CC7E21DBA15BF53E6F9507291951E98EAFC861C04E7ADD220740F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 10KB
SHA256 f4d87f413251be9acb5f0122a59e93c5ececb5f88ab49f2f258f2206c21a9589
MD5 8894204d5c4d1d2b789468de15369927
SHA1 1c07833076a1eb876867e288a99fd1b86b85c38d
SHA512 adb8a6a84053feba57eae3fae4ec5512d5c4780ce6b8fa41ce6331afff80777baabb4a4b1686274c6efa30092ff8fa4db59a3341d66111615386924281e91e05
SSDEEP 192:sxZ2R8kw/fasIJFIdpmjHW6+WNVrI/YCQYrS+KIg5tJ:sxZ2dw/fasIJ2MHbS//SFd
TLSH
T1EF32C7127E28A97B4CC7E20DBA15BF53E6F9507291951E98AAFC871C04E7ADD220740F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 27KB
SHA256 7d2737e881909677eb585db1a87e67b1fb9a02820fa7d2646489594c7caf6f5b
MD5 f35037622182d2281b8f87e7c29a4a43
SHA1 46213df555be09311f185a5ec80c60479301d1e7
SHA512 f295205289b471a14b5d15e4538b78f280bb4dcc4cdacf940f9b2aab48470e2461b884689a56add68a47ece5ba254db2cecf03c02650b6ae0847e2bb22b2dd06
SSDEEP 768:4QqbUj+WvSCs68F1+UoAYDCx9Tuqh0VfUC9xbog/OVHZLlRTKrTroo:4QqbUj+WvSCs6u1jaaZLbWrgo
TLSH
T16CC2E93B340CCA7E4FC01E9DDD5A6F972E9802C7A7588D4447FA994C02C77EA512A4DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 1KB
SHA256 e33e19c1a63e67aebde5dbec63271806c1692542764b66b4c446608f457a9ed8
MD5 6c6c3987e67cfff03a8059f1bbbf39ee
SHA1 a559272d0bf1156604555504a52eb95f42f58ba5
SHA512 1c3d4f8286ed79861e837652188b6602996ba2c9c6a4450453e7e9297cd12b8eeef037841cc3493ae5bd0c3878885111e7d3c6535dedaf7a90386954378bcd85
TLSH
T1E9213A11A9F606003C7E269CC1ACC767465170A7B0A6E43F7FEC10B58DA6E415BF98CD
MD5 SHA1 SHA512 TLSH

Submit Download

OperationConfig

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig~RFe5963a2.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig~RFe5963a2.TMP
Size 3KB
SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
MD5 904e6e94a1d46374c8630cfd86cc729f
SHA1 e1d9c3f7813878acc6510d48d95b2bf48b2e1a0d
SHA512 081e2a26252860ff8d8f7a9d0378ae56f0cc50574d13d2a121afdf74284963747ef874a4d73b1df7774cd8570972f4f513eefe0a0325fd088556d5b1ba946712
TLSH
T1DB815C4FCC0CBE77ABAB6A719A35D6B2F79131EA94518A977F8C444EE3050ED0242E50
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 20KB
SHA256 c5c917dcfbda118679d99ac58fcadf246a547fd594950b0f894073239d65a2aa
MD5 73df55b9adf5206de4daf0d8cc254a47
SHA1 029ae6c9e1cfb3a52d3a265914513bd4e5d20bf7
SHA512 ea6ce2317241bb698cc53470389c0f89b18a155c507956b3eff1269fa26c81951a94416c870efe9836a66e8df92a66128bccad474c7b9d9e30cd66c35eea5a71
SSDEEP 384:dZcIhsNMU4xA+JFEa+fd4ahBOOPrXLpe8C/x:FhhGa6vhBOi9Pu
TLSH
T17F928D7168B85C676DF6BA44E88736139FF840B7E6CA2BC4E6DCDB0D01D65680317826
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 896faa853a39501662d9b7acf52bece2b1e4b4c11c87da1141767196d762980b
MD5 8e5d9b2facd88075b595d77d555fa617
SHA1 c4bc674093ea518f86cb3f5d194f5f7ab5d584da
SHA512 2f1a6b272fba3410e9d49bf044a7fccf09904a694701655e201cadd36696ffe54d9e725de05a376c41af6c79c6cc26c6de92695b35876e07f5d07d04b624a7e3
SSDEEP 192:vONL6Db6QmiUykkHBa+j4+FdCXmR2RgXiU6:vONL6uCHBa+fdFSU6
TLSH
T1A702D73568786CBB9AF26E49F88737275FD4107BDA962B94D6D84F0C00D765C230783A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 20KB
SHA256 3dcb85c6aa64cb129a33bdc93cda0b20e3c858c05019f558138e8dcbadc159a7
MD5 8fbc215c9c1d79312040e31c5992ed47
SHA1 c9191e8f0dc869c764cf95b9d828953c95aea419
SHA512 2609481c4f0029a8f3ca166937980b8ebe643685cc8b2937cefe328c54a9fad52697d9c82d7d43a96d2856436c48d6f987157d38e9eb79e5fa3bb1fa3526b05e
SSDEEP 384:yZcIhsNMUBxA+JFEa+fd4ahBOOPrXLpe8C/x:Ah4Ga6vhBOi9Pu
TLSH
T16A928D7168B85C6769F6BA44F88736139FF840B7E6CA2BC4E6ECDB0D01D65680317826
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 27KB
SHA256 4e703a2eb11b5500c89bd4a49248d3e8481007f25b2e440c3e13f3067c7cf10e
MD5 19415268392a8fc1363fac83a3a422d7
SHA1 be1e03d6bcccea8693bea96987fb7d14472304fa
SHA512 3725d9a9c614e9923be6f7901c5f057611074765a8f4ef9f9f013bcbcc9be9500716aa36d665df8a1478bf4d07bac554f75e80f163472a2f4b02c96b8b10d503
SSDEEP 384:viFiZcIBsNN8TUNTUlIlBxA+XFEa+fd4a6BOOPrXLpe8C/x:6FQB8wgLGa6v6BOi9Pu
TLSH
T183D219F258D7483AE9AD6B47A77E2E135EBCC063F5856690B7C88A0CCC9617FC306811
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 e845dec877f7b993a49fa4ff3c98101506b033b3e84bf4e14ec9275505db90d9
MD5 a6a13cfec3d77c8a0e1e93affb39f1dc
SHA1 583551a96d65b8673bf9576ec9ac8a9dd0a42dc4
SHA512 ff1070ef7391c39fae3a04114597fbf3e70dd44d76234776f573e1fa19a0b4960d7f818b6163286c3a4d46ef5080b04eb222068e6878a6da5f3be6a944917b80
SSDEEP 192:VONe6DbyQmiUywk3Ba+j4+FdCXmRy/Fa9NzHq6U6:VONe62g3Ba+fd4aTBU6
TLSH
T13412183668686C7B5DE27944F88736135FE54167EE8B7B80D6DC9F0C00EB66C130B826
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

0dfb55b1-2651-4679-934b-9fb36fbe3cd8.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\0dfb55b1-2651-4679-934b-9fb36fbe3cd8.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 35fa0f103282896cdd427b17d5963d887c8287570dae46d9bfc38630768a8877
MD5 ffcd15c536e33078e7c0c7184750d81d
SHA1 7f808c1ff5e8995e51404bf661c184a543efb891
SHA512 b86639be1cbaaa90c219cb73d2c9b4afd81d8f75fbab6f2333616ecd1335d3ae5c11193f8d82bc9249970d2ae2be2b718acce4901429c83b62a53f0fe54e9510
TLSH
T1D041F648A6FA1144B3B76F569FF2A46E487A79772F06916E00110E4E0A62B44CCB2737
MD5 SHA1 SHA512 TLSH

Submit Download