hxxps://www[.]stb[.]gov/upns-eis-fd36873/wp-content/uploads/sites/5/UP-NS-Agency-Preliminary-Consultation-Letter[.]pdf

Analysis

user interaction
yes
max time kernel
149s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
19/08/2026, 19:09

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://www.stb.gov/upns-eis-fd36873/wp-content/uploads/sites/5/UP-NS-Agency-Preliminary-Consultation-Letter.pdf
Sample260819-xtzqlstybs

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4340	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134316401770846809"	msedge.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-889581200-2041691093-2048517887-1000\{C05C9A6B-7F5F-4A87-9FE8-BE6DA4B243A1}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
5976	msedge.exe
5976	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
4936	msedge.exe
4936	msedge.exe
4936	msedge.exe
4936	msedge.exe
4936	msedge.exe
4936	msedge.exe
4936	msedge.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
4936	msedge.exe
4936	msedge.exe
4936	msedge.exe
4936	msedge.exe
4936	msedge.exe
4936	msedge.exe
4936	msedge.exe
4936	msedge.exe
4936	msedge.exe
4936	msedge.exe
4936	msedge.exe
4936	msedge.exe
4936	msedge.exe
4936	msedge.exe
4936	msedge.exe
4936	msedge.exe
4936	msedge.exe
4936	msedge.exe
4936	msedge.exe
4936	msedge.exe
4936	msedge.exe
4936	msedge.exe
4936	msedge.exe
4936	msedge.exe
4936	msedge.exe
4936	msedge.exe
4936	msedge.exe
4936	msedge.exe
4936	msedge.exe
4936	msedge.exe
4936	msedge.exe
4936	msedge.exe
4936	msedge.exe
4936	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
4936	msedge.exe
4936	msedge.exe
4936	msedge.exe
4936	msedge.exe
4936	msedge.exe
4936	msedge.exe
4936	msedge.exe
4936	msedge.exe
4936	msedge.exe
4936	msedge.exe
4936	msedge.exe
4936	msedge.exe
4936	msedge.exe
4936	msedge.exe
4936	msedge.exe
4936	msedge.exe
4936	msedge.exe
4936	msedge.exe
4936	msedge.exe
4936	msedge.exe
4936	msedge.exe
4936	msedge.exe
4936	msedge.exe
4936	msedge.exe
4936	msedge.exe
4936	msedge.exe
4936	msedge.exe
4936	msedge.exe
4936	msedge.exe
4936	msedge.exe
4936	msedge.exe
4936	msedge.exe

Suspicious use of WriteProcessMemory 36 IoCs

description	pid	Process	procid_target
PID 4936 wrote to memory of 4768	4936	msedge.exe	85
PID 4936 wrote to memory of 4340	4936	msedge.exe	86
PID 4936 wrote to memory of 2016	4936	msedge.exe	87
PID 4936 wrote to memory of 2016	4936	msedge.exe	87
PID 4936 wrote to memory of 2016	4936	msedge.exe	87
PID 4936 wrote to memory of 1568	4936	msedge.exe	88
PID 4936 wrote to memory of 1568	4936	msedge.exe	88
PID 4936 wrote to memory of 2192	4936	msedge.exe	90
PID 4936 wrote to memory of 3612	4936	msedge.exe	89
PID 4936 wrote to memory of 2192	4936	msedge.exe	90
PID 4936 wrote to memory of 2192	4936	msedge.exe	90
PID 4936 wrote to memory of 3612	4936	msedge.exe	89
PID 4936 wrote to memory of 3612	4936	msedge.exe	89
PID 4936 wrote to memory of 2520	4936	msedge.exe	92
PID 4936 wrote to memory of 2520	4936	msedge.exe	92
PID 4936 wrote to memory of 2520	4936	msedge.exe	92
PID 4936 wrote to memory of 1988	4936	msedge.exe	93
PID 4936 wrote to memory of 1988	4936	msedge.exe	93
PID 4936 wrote to memory of 1988	4936	msedge.exe	93
PID 4936 wrote to memory of 2012	4936	msedge.exe	96
PID 4936 wrote to memory of 2012	4936	msedge.exe	96
PID 4936 wrote to memory of 2012	4936	msedge.exe	96
PID 4936 wrote to memory of 936	4936	msedge.exe	98
PID 4936 wrote to memory of 936	4936	msedge.exe	98
PID 4936 wrote to memory of 936	4936	msedge.exe	98
PID 4936 wrote to memory of 616	4936	msedge.exe	99
PID 4936 wrote to memory of 1848	4936	msedge.exe	100
PID 4936 wrote to memory of 616	4936	msedge.exe	99
PID 4936 wrote to memory of 1848	4936	msedge.exe	100
PID 4936 wrote to memory of 4332	4936	msedge.exe	102
PID 4936 wrote to memory of 1636	4936	msedge.exe	111
PID 4936 wrote to memory of 4692	4936	msedge.exe	112
PID 4936 wrote to memory of 4968	4936	msedge.exe	113
PID 4936 wrote to memory of 5376	4936	msedge.exe	127
PID 4936 wrote to memory of 5376	4936	msedge.exe	127
PID 4936 wrote to memory of 5976	4936	msedge.exe	132

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://www.stb.gov/upns-eis-fd36873/wp-content/uploads/sites/5/UP-NS-Agency-Preliminary-Consultation-Letter.pdf
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4936
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x2a0,0x7ff9f3a4c188,0x7ff9f3a4c194,0x7ff9f3a4c1a0
  2⤵
  PID:4768
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1836,i,4192153475067901878,14305305156293727064,524288 --field-trial-handle=2824,i,12328048335152906102,14546374985893258946,262144 --variations-seed-version --mojo-platform-channel-handle=2964 /prefetch:3
  2⤵
  - System Time Discovery
  PID:4340
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1632,i,12848413043131557738,1863001406003632172,262144 --field-trial-handle=2824,i,12328048335152906102,14546374985893258946,262144 --variations-seed-version --mojo-platform-channel-handle=2820 /prefetch:2
  2⤵
  PID:2016
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2288,i,13405672083002773710,13279928364921739224,524288 --field-trial-handle=2824,i,12328048335152906102,14546374985893258946,262144 --variations-seed-version --mojo-platform-channel-handle=2948 /prefetch:8
  2⤵
  PID:1568
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3432,i,6702297244425254132,16597105284701289169,2097152 --field-trial-handle=2824,i,12328048335152906102,14546374985893258946,262144 --variations-seed-version --mojo-platform-channel-handle=3508 /prefetch:1
  2⤵
  PID:3612
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3436,i,8844831188084145966,5395282520191883700,2097152 --field-trial-handle=2824,i,12328048335152906102,14546374985893258946,262144 --variations-seed-version --mojo-platform-channel-handle=3512 /prefetch:1
  2⤵
  PID:2192
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4128,i,4751485679819293508,3166014808219548138,2097152 --field-trial-handle=2824,i,12328048335152906102,14546374985893258946,262144 --variations-seed-version --mojo-platform-channel-handle=4156 /prefetch:1
  2⤵
  PID:2520
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4140,i,18354086074785823068,1409916914198873732,2097152 --field-trial-handle=2824,i,12328048335152906102,14546374985893258946,262144 --variations-seed-version --mojo-platform-channel-handle=4184 /prefetch:2
  2⤵
  PID:1988
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --init-isolate-as-foreground --pdf-shared-library --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=3504,i,12552497327216822262,10988642488193495101,2097152 --field-trial-handle=2824,i,12328048335152906102,14546374985893258946,262144 --variations-seed-version --mojo-platform-channel-handle=5088 /prefetch:2
  2⤵
  PID:2012
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --renderer-sub-type=pdf-renderer --pdf-renderer --pdf-shared-library --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags="--ms-user-locale= --jitless" --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --always-read-main-dll --metrics-shmem-handle=3732,i,677423427144121386,6565602149973992298,2097152 --field-trial-handle=2824,i,12328048335152906102,14546374985893258946,262144 --variations-seed-version --mojo-platform-channel-handle=5268 /prefetch:8
  2⤵
  PID:936
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5464,i,7204028616974668469,9583530771527863159,524288 --field-trial-handle=2824,i,12328048335152906102,14546374985893258946,262144 --variations-seed-version --mojo-platform-channel-handle=5520 /prefetch:8
  2⤵
  PID:616
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5456,i,12471436139026042693,16347851422484666568,524288 --field-trial-handle=2824,i,12328048335152906102,14546374985893258946,262144 --variations-seed-version --mojo-platform-channel-handle=5540 /prefetch:8
  2⤵
  PID:1848
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6196,i,13372696025404143321,12098961296410506404,524288 --field-trial-handle=2824,i,12328048335152906102,14546374985893258946,262144 --variations-seed-version --mojo-platform-channel-handle=6224 /prefetch:8
  2⤵
  PID:5020
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6196,i,13372696025404143321,12098961296410506404,524288 --field-trial-handle=2824,i,12328048335152906102,14546374985893258946,262144 --variations-seed-version --mojo-platform-channel-handle=6224 /prefetch:8
  2⤵
  PID:4332
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4184,i,2324430010857637432,1378208420555776623,524288 --field-trial-handle=2824,i,12328048335152906102,14546374985893258946,262144 --variations-seed-version --mojo-platform-channel-handle=6220 /prefetch:8
  2⤵
  PID:1636
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3736,i,9567514535977392204,2868951464101664513,524288 --field-trial-handle=2824,i,12328048335152906102,14546374985893258946,262144 --variations-seed-version --mojo-platform-channel-handle=6600 /prefetch:8
  2⤵
  PID:4692
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4260,i,6698961469490088785,412005636565698536,524288 --field-trial-handle=2824,i,12328048335152906102,14546374985893258946,262144 --variations-seed-version --mojo-platform-channel-handle=4424 /prefetch:8
  2⤵
  PID:4968
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6048,i,909330715930278166,10081648644203213307,524288 --field-trial-handle=2824,i,12328048335152906102,14546374985893258946,262144 --variations-seed-version --mojo-platform-channel-handle=3728 /prefetch:8
  2⤵
  PID:5376
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6836,i,16496493829072614244,17864989238633336437,262144 --field-trial-handle=2824,i,12328048335152906102,14546374985893258946,262144 --variations-seed-version --mojo-platform-channel-handle=6544 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5976

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:4248

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

blocklist

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\blocklist
Size 105KB
SHA256 002da0388695fb666e2e2cc5c4c14b46ce89c67287834e4237f7a57a915026ab
MD5 dcf64b946cc9c0be4b829a0cf3738125
SHA1 237670c728da3df21dc676aa6d57f2fe3e3229bc
SHA512 ad71e9ab830fb68da334fcb7022f1852e850ecc35f4169c2152b8d75f06902de892e8022e4e5f8ebcf85dde2cba00f98bc48fef016190253cff6f6ea6906672e
SSDEEP 1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P7D:fwUQC5VwBIiElEd2K57P7D
TLSH
T185B3B931457E36BF26E93EE828CF1511B84F3912664895D4ABE1FE2C4845E68633CEF4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 11d3c4c52f9fc9cd2b10a22b48769759f994fd6364f9a0fc145f4cd2c2a22e9d
MD5 4751cf705a737c4226029624bf43b9a8
SHA1 fd8cf726ee3f8f75b97147829de5553530caa82c
SHA512 46e3fedbf7fa14bdc2b3aad129f2879a9d24252f5d7bd9b55766bc32a6b82ea77aaf193bcdbdf4423e3b67ef84955e589b6077609344091ef72204c1d50b0dab
TLSH
T17ED09B307A58A58BD14360F1A4114B4115375557205397757521508E9E98055B3CA057
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 9580e333469b18f3e987a32495a655533e5995550e362227d81e7841d0f38906
MD5 1ede13bc33d6ef954687b5109f83322f
SHA1 140af73147bcae8571c3f063725b4169af41537d
SHA512 888c3ba70a79ddc8648a164d7e6ab68d36ff9dad97388a0b2ffe6652c16f93ee19b2131ddea1d5cf0f7cae6f3e61922875c10edd75473c20713e58de3af3b1a2
TLSH
T1B351FB10C2521E81FB91123388D01B64337595983BC76F46F2C854F95E0EF6E9E7D959
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe590a37.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe590a37.TMP
Size 2KB
SHA256 66307a911c2c7dc8cf75ef07fd45f41d9ebbdc2be2e931506504359a932caa71
MD5 c390b78ddea1cca88258aa6350bc7a89
SHA1 971cd121bb0514c0b280b47383673e1d45d3ddae
SHA512 4684e83388c62bbea054a8d43aa663f3786bf384d3c62b830ea16916473057f68072a5f5edf299e7135d645a978bed3ddfe032f1da34cc6ee123ac3021196911
TLSH
T1B8513D24C3520E91EB915233D0D02754367AD6D83BC76F94F29858F91E0EF2E5E7E119
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 1KB
SHA256 2cbca3ad4a1690bf9d5957ac6f83ed72397c4586e9f1d73d510d58a98eed7aef
MD5 7c766b8460429ed7fe72bcc7a2b49d2f
SHA1 aa75244ac3f2e6d6f00afb00a0b03a70bb05afaa
SHA512 1098cb4d4fc86f7ebabdf6a59bac858d9345835d46131eea581a9666ff0a094d367a062b5ca0d26bdbbb879ee166fabd2e800223a2a5b5857cdf30980c8971c3
TLSH
T18A11AAF3C3E185AE8A1156F06A24AE2BCE2D0616422C7C1A89D4FF2B93F3475E10195B
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 21a1007bf91d0f7ff7e9c8e9aa0089b5dca05e0de756fb1ccddbdb7545636221
MD5 0e89478d995463e3b9e0b4d442654f39
SHA1 a97cbeeda439d6ba8467fc99dfc955b8e44f4a5b
SHA512 f2724adf648d5c49227885184c06a3caeb38d3f517d032de3177cee421d90e5ead9b0a0d54e24fe7ee4dce01b029dda275434eefb9f28e492fc3c5be16532ecb
SSDEEP 192:sxZwQUnMRFyM/jK1Ml8UQAk8/fms/n6uCodpAyHW6+WNA8yxY9IlhOwfLiIg51J:sxZ2nMLqT8/fms/nnTHbWxfO7l
TLSH
T13962E811AA386977CCDBE20DF955BF53D6F5147292910E44AEFC8A1C00EABED220381F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 444a4e6cabe48df53fa4749cd9a6a5d461cc88a3dcf3b588e871b863b507b59e
MD5 45870ee5ee98a45870a32cf7a47cd9cc
SHA1 a8c8491e5ac92391db86fe55123a28301dbec343
SHA512 be3ba79eb85ae65ba535309c8452ef235c4ef534ec1da575e7bebc66d2c0714f3f00e5e7bbd5449583c8b84c6982363c87c7e6c3d03ad9bbccb4c8a3413fb59c
SSDEEP 192:sxZwQUnMRFyM/jK1Ml8Mk8/fmsV+6uCodpCyHW6+WNAuV/Y9ICjOwwkiIgrJ:sxZ2nMLM8/fmsV+nhHbz/YON9
TLSH
T15E52F9116A386977CCDBE209FA15BF53D6F9157292950E44EEFC891C00E6BED220781F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 30KB
SHA256 f6cc2d48326f9b5a2ab718fd35f703e5662284cd1ac7d552ed6606b80e702810
MD5 470681dd0e36e3a8ffcab721cf11df6a
SHA1 c600478737ac121cae0545794b7c978808ab5a77
SHA512 83abf38855129458785ca856df65605a435f35be68730d41438c9d1a74d96960cefeba2f9a85c72cb8d6a45292b8af575c4e549204e13a1c351fa1d52cd797fb
SSDEEP 768:dacv21wWvu+Z+8F1+UoAYDCx9Tuqh0VfUC9xbog/OVjFLlwmWN2roDg6C:dacv21wWvu+Z+u1jaeFLeRNNDy
TLSH
T1FAD20A2B280CCB7E4F841E9CED2A6F8A6DD801CB57988D5447FA894C03C77EB511B59B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 5KB
SHA256 7722b45bd8ffd72dc9f809a42282ee44ccfaa3a87a5e45393214f25b03e0e60c
MD5 9cd6d60be0cf4b74a919f77690d765fe
SHA1 bb4ae45d72d60cef1bce1c8cc9354bedf1a1ff0a
SHA512 02d83c61bafcef5e34e266deffdbfc25b36c97f3f3e3edf054fa3bfd3c9230c771577e0b6f6e9ab822dbac9d1b911a70230a0b591a1ad6de9fe036d3762c1b54
SSDEEP 96:KaRklRnHnqlPKZThqKLfTzqHxJSrBD6aEKPaGO1WKO06C4AKFeF:mTfLRl7e
TLSH
T168C17616B1374642387E7808A7A686374F4531A7781CB4AF7FB800665E2BE115DFE4CD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 24KB
SHA256 6014168fe6d6ad481c4c197f80df1d08b10fa3eaf7c88337b74a3889353fdb14
MD5 541f6a0e3d93f08dc3f9461c7f346637
SHA1 0d96202e03fdf0f96f0e26800349ac2eaa689595
SHA512 46c3d66da71ed1908b01817eaed577da33befc46ddf931a4a38fb2f56a4400ba47060a024a3f1abb76041e0311a69f476601f27bcbc59a3778d871f9473602ba
SSDEEP 384:9nZcInsNCngziQ3khye+CzO4eyfxhivo+a41oT:9Pn4j3+lrOXyfxhiwlQU
TLSH
T198B22AF558EB5836D5ADA383E77E2D134E7CC063B1852A4077D85A2CCC8A6BFD306415
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 24KB
SHA256 f499e6fa71796636c9e6e17b2533bf6afc0820c2edd3b7035689d5bf95ed581b
MD5 43e4cbd7727e8421293cabeb29d9a09b
SHA1 ad1891879ae7efeccbbe17ba7f9291e24dbf7d91
SHA512 2cca913d3da21e6027ffd1302751119872bd7c413591a1a099c2a479a699f6ea5b3bad098243b838b269fd6af5850afc8d08681a48cf3d0f037807d7bc4eee32
SSDEEP 384:9nZcIcAsNrngziQPhye+CzO4eyfghivo+a41oT:9PBJjZlrOXyfghiwlQU
TLSH
T121B229F558EB5836D5ADA383E77E2D138E7CC063B1852A4077D85A2CCC8A6BFD302415
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 694d092ebf77fb2fe5ebd41f11e3950ac8c84e8065c032fb7e905c0ebfd71f76
MD5 d8c4d6aab455bd5fd15ec68dedea1130
SHA1 6b1838907a5ba5110714fa2e30def137a5d07c30
SHA512 e5eb055d06bbc405ad1525a6736115769711c58719af2609ad3a8b2b4aec32564a86fcd99170de78789530b3c9bc2061c125beee85418afd254b4ca4d09c799d
SSDEEP 192:JONW6v+YLNQmiUyanZh+CGSO49oQus9tU6:JONW6vz/zZh+CzO4eGHU6
TLSH
T1F602D9357D381C7B9FE2AE45F58736275FA81177E9912F80D9E82E1C01D764C2306826
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 e9348ce89d598a799b06243ab190240092bb3ef080f737310827f74b99016be3
MD5 20ed7fac1bb3a5d6bfb600ae86c3d71a
SHA1 f7afabb95345610769028304cac8c9c5951f121f
SHA512 42001d7277a9e7e070bf3e4adce987b78984f2b9d35b76101baf4bf9edaa25563f1156080989b893e128dda3815e716b529d6afe85b3a303bc58fda123c39120
SSDEEP 192:ZOON+6v+YLS1QmiUySnuh+CGSO49oyfQCH7q+U6:ZOON+6vzGTtuh+CzO4eyfxhU6
TLSH
T12C120A35BD385C7B5EE2A584F48736139EA85167EA867F80D5DC3E2C01DF69C2306816
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 8b87ca53523e2316c00c959ab2875f955fc1d3770afdb29deec6c9d9cd1e6d44
MD5 a3ec5c2efe140579bb6a23780d97ac80
SHA1 9b8ce22c57ece0947359d1c36b1cad2b30dbf41b
SHA512 719e65ba67b8803e0db186d6fde01b290bc2cdba89259d68d168b4cb72c6d874992e9ab7ccb891292f221af0f97a14bb3ae7f83fa70d2cb72531abd9826f3477
SSDEEP 384:PPZcIhsNrigziQ86ye+CzO4eyfPhivo+a41oT:PHh6jtlrOXyfPhiwlQU
TLSH
T174827C766D385C7729E2A284F9463A178FB84077D6CA7F4095DCAF2C01DE6D8130792A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 b837311e368adbecbd0d2502c426efd59aaa7cb6051d2c6bdd33b0fba5d16cc9
MD5 2a1c847df11f2d1cb7631e52be3a2672
SHA1 8d412eafc2af46e5fdd3b570f7989ec701539141
SHA512 9a3a550995feae1702b2402d9803c7691102166618e3189199738f2303fab9cf0154380b00f62a3d1294fca3a673bf5a1eb05a6a0f720e5a5790b27a2af73e7f
SSDEEP 384:zPZcIBAsNrngziQP6ye+CzO4eyfPhivo+a41oT:zHyJjClrOXyfPhiwlQU
TLSH
T1AA927D766D385C7729E2F284F9463A179FB84077D6CA2F4095ECAF2D01DE6981307826
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\metadata.json
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 45d754b785f7ab01eb89d22b5acef464b700082bb5172cfbd00972a9607ae4e2
MD5 c47ed37cef32e2f2018fb40886fc1035
SHA1 1c701ff5eeb6b24c94601c6dd5ba5e0416dfcd45
SHA512 c80c488a409095a21c24e21b6d66a1394f7ace6d876684657f4a4b0212f1afb993603392048eda45c765e5031f8d62b858942ec65a5945f0f8563e87b14ffab7
TLSH
T11641D659A6FE1148B3776F5AAFF6A9AE447FB9372E0AD05D00110D4E0A66F00C871B37
MD5 SHA1 SHA512 TLSH

Submit Download