91002aa4142e7be6b2141e51e87a7e6803003415e5cb90e2b9f0daea097b8758

Analysis

user interaction
yes
max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
20/08/2026, 11:44

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
yq2sCiSLJeTWerk.html
Size 26KB
Sample260820-nv9grsbm5x
SHA256 91002aa4142e7be6b2141e51e87a7e6803003415e5cb90e2b9f0daea097b8758
MD5 fa69affd87c4e82a811643ed6a4efbd1
SHA1 57a5fa92a2c96d510f5896d06d916dad800c2a7c
SHA512 d6ae43488b5c1f95a22bcecd001b3d6f6f0d774e3feddd2c9027ce23dbd38e0f9ad78b08abb9ffd006e0153b1801a2542448b47c3e7d4c91c022ff8565a5a8dc
SSDEEP 768:PHCMSCDCXCgCbCpCqCnCGC+CZCrCrC3CPCZC9ClzCaCWC5C+CxCBCvCvkibmVTRZ:PHCMSCDCXCgCbCpCqCnCGC+CZCrCrC3H
TLSH
T1DEC20A438C86CD364916C5B8F2BCA52ED28FF840BB561CCE7B8A455F015BED1437A36A
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4300	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134317019038803069"	msedge.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-876885714-46325919-1482798410-1000\{A88B6D3F-7F4E-47B3-88E3-89174E0DFFA9}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2940	msedge.exe
2940	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
1212	msedge.exe
1212	msedge.exe
1212	msedge.exe
1212	msedge.exe
1212	msedge.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
1212	msedge.exe
1212	msedge.exe
1212	msedge.exe
1212	msedge.exe
1212	msedge.exe
1212	msedge.exe
1212	msedge.exe
1212	msedge.exe
1212	msedge.exe
1212	msedge.exe
1212	msedge.exe
1212	msedge.exe
1212	msedge.exe
1212	msedge.exe
1212	msedge.exe
1212	msedge.exe
1212	msedge.exe
1212	msedge.exe
1212	msedge.exe
1212	msedge.exe
1212	msedge.exe
1212	msedge.exe
1212	msedge.exe
1212	msedge.exe
1212	msedge.exe
1212	msedge.exe
1212	msedge.exe
1212	msedge.exe
1212	msedge.exe
1212	msedge.exe
1212	msedge.exe
1212	msedge.exe
1212	msedge.exe
1212	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
1212	msedge.exe
1212	msedge.exe
1212	msedge.exe
1212	msedge.exe
1212	msedge.exe
1212	msedge.exe
1212	msedge.exe
1212	msedge.exe
1212	msedge.exe
1212	msedge.exe
1212	msedge.exe
1212	msedge.exe
1212	msedge.exe
1212	msedge.exe
1212	msedge.exe
1212	msedge.exe
1212	msedge.exe
1212	msedge.exe
1212	msedge.exe
1212	msedge.exe
1212	msedge.exe
1212	msedge.exe
1212	msedge.exe
1212	msedge.exe
1212	msedge.exe
1212	msedge.exe
1212	msedge.exe
1212	msedge.exe
1212	msedge.exe
1212	msedge.exe
1212	msedge.exe
1212	msedge.exe

Suspicious use of WriteProcessMemory 34 IoCs

description	pid	Process	procid_target
PID 1212 wrote to memory of 4404	1212	msedge.exe	85
PID 1212 wrote to memory of 4300	1212	msedge.exe	86
PID 1212 wrote to memory of 3672	1212	msedge.exe	87
PID 1212 wrote to memory of 3672	1212	msedge.exe	87
PID 1212 wrote to memory of 3672	1212	msedge.exe	87
PID 1212 wrote to memory of 4528	1212	msedge.exe	88
PID 1212 wrote to memory of 4528	1212	msedge.exe	88
PID 1212 wrote to memory of 2496	1212	msedge.exe	89
PID 1212 wrote to memory of 2496	1212	msedge.exe	89
PID 1212 wrote to memory of 2496	1212	msedge.exe	89
PID 1212 wrote to memory of 2196	1212	msedge.exe	90
PID 1212 wrote to memory of 2196	1212	msedge.exe	90
PID 1212 wrote to memory of 2196	1212	msedge.exe	90
PID 1212 wrote to memory of 2268	1212	msedge.exe	92
PID 1212 wrote to memory of 2216	1212	msedge.exe	93
PID 1212 wrote to memory of 2268	1212	msedge.exe	92
PID 1212 wrote to memory of 2268	1212	msedge.exe	92
PID 1212 wrote to memory of 2216	1212	msedge.exe	93
PID 1212 wrote to memory of 2216	1212	msedge.exe	93
PID 1212 wrote to memory of 3100	1212	msedge.exe	97
PID 1212 wrote to memory of 4928	1212	msedge.exe	98
PID 1212 wrote to memory of 3100	1212	msedge.exe	97
PID 1212 wrote to memory of 4928	1212	msedge.exe	98
PID 1212 wrote to memory of 2368	1212	msedge.exe	100
PID 1212 wrote to memory of 1924	1212	msedge.exe	107
PID 1212 wrote to memory of 1580	1212	msedge.exe	108
PID 1212 wrote to memory of 1988	1212	msedge.exe	109
PID 1212 wrote to memory of 4500	1212	msedge.exe	120
PID 1212 wrote to memory of 4500	1212	msedge.exe	120
PID 1212 wrote to memory of 3784	1212	msedge.exe	121
PID 1212 wrote to memory of 3784	1212	msedge.exe	121
PID 1212 wrote to memory of 1884	1212	msedge.exe	123
PID 1212 wrote to memory of 1884	1212	msedge.exe	123
PID 1212 wrote to memory of 2940	1212	msedge.exe	126

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument C:\Users\Admin\AppData\Local\Temp\yq2sCiSLJeTWerk.html
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1212
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x24c,0x7ffbf4cec188,0x7ffbf4cec194,0x7ffbf4cec1a0
  2⤵
  PID:4404
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1824,i,96635614025974731,1212980001609230707,524288 --field-trial-handle=2992,i,4734365310035766582,12149529361026514357,262144 --variations-seed-version --mojo-platform-channel-handle=3020 /prefetch:3
  2⤵
  - System Time Discovery
  PID:4300
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1628,i,589982837877834611,6302429042864588302,262144 --field-trial-handle=2992,i,4734365310035766582,12149529361026514357,262144 --variations-seed-version --mojo-platform-channel-handle=2892 /prefetch:2
  2⤵
  PID:3672
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2320,i,11872183932509208958,13361405156836715658,524288 --field-trial-handle=2992,i,4734365310035766582,12149529361026514357,262144 --variations-seed-version --mojo-platform-channel-handle=3036 /prefetch:8
  2⤵
  PID:4528
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3424,i,13209787371291786837,16558280854943759421,2097152 --field-trial-handle=2992,i,4734365310035766582,12149529361026514357,262144 --variations-seed-version --mojo-platform-channel-handle=3500 /prefetch:1
  2⤵
  PID:2496
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3428,i,14714267844317212470,3572836249607459256,2097152 --field-trial-handle=2992,i,4734365310035766582,12149529361026514357,262144 --variations-seed-version --mojo-platform-channel-handle=3504 /prefetch:1
  2⤵
  PID:2196
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4112,i,5367310657391819830,11772786277697032334,2097152 --field-trial-handle=2992,i,4734365310035766582,12149529361026514357,262144 --variations-seed-version --mojo-platform-channel-handle=4136 /prefetch:1
  2⤵
  PID:2268
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4140,i,6479085753284805315,14756960685598483282,2097152 --field-trial-handle=2992,i,4734365310035766582,12149529361026514357,262144 --variations-seed-version --mojo-platform-channel-handle=4168 /prefetch:2
  2⤵
  PID:2216
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5028,i,12116395753508373845,10813015545255366926,524288 --field-trial-handle=2992,i,4734365310035766582,12149529361026514357,262144 --variations-seed-version --mojo-platform-channel-handle=5108 /prefetch:8
  2⤵
  PID:3100
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5032,i,17417496933071726238,14831670523472891203,524288 --field-trial-handle=2992,i,4734365310035766582,12149529361026514357,262144 --variations-seed-version --mojo-platform-channel-handle=5152 /prefetch:8
  2⤵
  PID:4928
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5872,i,5227649608012048035,13272951409001564067,524288 --field-trial-handle=2992,i,4734365310035766582,12149529361026514357,262144 --variations-seed-version --mojo-platform-channel-handle=5888 /prefetch:8
  2⤵
  PID:3244
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5872,i,5227649608012048035,13272951409001564067,524288 --field-trial-handle=2992,i,4734365310035766582,12149529361026514357,262144 --variations-seed-version --mojo-platform-channel-handle=5888 /prefetch:8
  2⤵
  PID:2368
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4468,i,15537721677425513011,140390957576494076,524288 --field-trial-handle=2992,i,4734365310035766582,12149529361026514357,262144 --variations-seed-version --mojo-platform-channel-handle=4248 /prefetch:8
  2⤵
  PID:1924
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4452,i,16187242361770076497,4764444409508027671,524288 --field-trial-handle=2992,i,4734365310035766582,12149529361026514357,262144 --variations-seed-version --mojo-platform-channel-handle=4440 /prefetch:8
  2⤵
  PID:1580
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4456,i,17428171579142369663,13613037142928293529,524288 --field-trial-handle=2992,i,4734365310035766582,12149529361026514357,262144 --variations-seed-version --mojo-platform-channel-handle=5884 /prefetch:8
  2⤵
  PID:1988
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5180,i,988265171137671305,1093255083678011563,524288 --field-trial-handle=2992,i,4734365310035766582,12149529361026514357,262144 --variations-seed-version --mojo-platform-channel-handle=1008 /prefetch:8
  2⤵
  PID:4500
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5816,i,7594258600108676236,12382480050833049742,524288 --field-trial-handle=2992,i,4734365310035766582,12149529361026514357,262144 --variations-seed-version --mojo-platform-channel-handle=5852 /prefetch:8
  2⤵
  PID:3784
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=760,i,5953559833910664500,10316186478973673700,524288 --field-trial-handle=2992,i,4734365310035766582,12149529361026514357,262144 --variations-seed-version --mojo-platform-channel-handle=5144 /prefetch:8
  2⤵
  PID:1884
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=5028,i,12872661390119599794,10599793972297335376,262144 --field-trial-handle=2992,i,4734365310035766582,12149529361026514357,262144 --variations-seed-version --mojo-platform-channel-handle=6108 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2940

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:1244

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

blocklist

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\blocklist
Size 105KB
SHA256 8b518cc4421c5378643bd130fcafdd16cf5510be04e28777acdc48008baf4b75
MD5 838f79643836e53f9a3ce9481f3b3d0d
SHA1 6ad8af3576534044699b9980aa616b31acb75fa5
SHA512 d6ab2131d7539433289dca482b6a43f5cb0c1d42b925f9d88f99ac6a548d5fc36df3964595d9b1006a18a315c8f3630772905d6357457ac1978a3d978f6e2e5e
SSDEEP 1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P7g:fwUQC5VwBIiElEd2K57P7g
TLSH
T164B3B931457E36BF26E93EE828CF1511B84F3912664895D4ABE1FE2C4845E68633CEF4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 6de34b260036ecaa4ce5839bc4a7ff7495e50b7b94349b12d9f840ca0e76da3b
MD5 56d82099872fb501c566d072ae897035
SHA1 2c96501551fc13c09496780960d8e7ccb4957b77
SHA512 c4b4017256caf25e88f146e6104134cddfd15089203e8e74c5196627fc92897f9fe7e3fc5c8305032be88e9409cdbc5dfe1e81017fcd5e38b3579b3d823b4a41
TLSH
T160D0C073378C7C00EA090170D013C3031FA7855824C39F03B100C01C54B43D9738B093
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 f5dece638cd89af82b06bd2fcb3d1738eef64d2275be237184ea8bff7af3fdfa
MD5 f19ec2293392af872f10929c41627e26
SHA1 0576f5277c470f5bb8c3f4d3786ca8d967d0a33e
SHA512 4cc85dc71d34bb516f8fe45b565a6a9b4cda255a931f33289247ed84150baf0e2df40fc87109df41771553b92545ed858197cdd3d673694c83458cf9812aa9dd
TLSH
T16CD02272268C6C00EA090170D01383021EA6855824839B03A100C01C44A52D9728A093
MD5 SHA1 SHA512 TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 357B
SHA256 1b4c02da4de2a31d1e8827e0b4ee3154fe0a50bee0d69846d78cbe735eb20b02
MD5 63e05f0144bbacc57e8ea9390ec7e730
SHA1 4c95708d4967954f430843e5223f5d9aa77273b8
SHA512 306959eefa6cc96a1664dd85ddc96f6b75364ac025117387085bb732de59c048c1d52d4817ed4a5c17a817a1c4b9cef0044480efd32d264b1639f2c154a1886b
TLSH
T136E026E52BFBC1A5AD88D487E2EC731CC07E7086A6BCE8AE3608E1AC34E0400D742494
MD5 SHA1 SHA512 TLSH

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\MANIFEST-000001
Size 158B
SHA256 3d4a599c612694b614ba7c8e8efa5c94b221ade6a1a44d0b68472c17fbfe4598
MD5 b7a429b099eba1a8e9cd144e4d00599a
SHA1 e087a559e4468b4c6b5596bf6fe6af3fc3affe59
SHA512 49ab5ffa12f6d0bdc5a8d4aacc121fa8c6c253560915cebe1d462fd6f5f859f005f30761c684b7bc0bd2642d039f068c353c37babcb54cc98e5a33b9c8ac49da
TLSH
T103C0809CBD4DD4DED381187E5716F00007606512941796130650BCD07580DF41E39120
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 7adf289e902260cd9a61e8b3aad92cc5454aefb50ce7da5754e87ee9e227a5d0
MD5 504a44f20009becf21c44d5fb1ba9b57
SHA1 897ee0194768e2f4c7db8a18e3f932b6a68dc96b
SHA512 23be25a0ccb4f979ba6dc70fa929e8e40da37bd5adc003b36be4364dd5c91042bedbcfd6d9e2ee4b1bc8b31c074c8fd952aa6d191a7a62e894b44a7ebe809abf
TLSH
T11971816F8D4201D3EF611131D1DA1A03373E8DA94903BED5225498BDB82EB67F0D9D78
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe58a9f7.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe58a9f7.TMP
Size 3KB
SHA256 e4c35a5c579f5a14c0816f2e310b24e99886f925b84626a2202a80e6ec61298c
MD5 67bcdbb8cf1fc4cbdc4773be4a53b81b
SHA1 964d5342356db37a4f577a90540a7204f8101bf9
SHA512 741cbfc2fa7bcc42b5322a6a6f7561d5e56027fbe80abfe04f23843a40ffbd2e4116637e2da7b738e1e8bd48a188010ccd3c69be4c5f7d2628bc7d9b785e5130
TLSH
T13771816F8D4201D3EF211131D5DA1A03373E8DA94903BED2115498BDB82EB67F1D9D78
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 949B
SHA256 5ec54377236ab40211fe638cb4d0a5901ad2d62c4f1ccbdff571a978264fcab3
MD5 3f7ee64e10e8fb18c4d92a56adce7ca9
SHA1 cb40a463ef5e10811581a42a7e3ddfd57370e0f0
SHA512 879b3c69e8a652b1882cc3c89094362367d763fc9ab8cc5dbec0df7008d2a53ae515c5919e18b20ed94a072521027f2368dbdc0872de4a45a023461ea7b707ea
TLSH
T159117AF3C7D595AECA0117F05A24AE2BCE2D0606822C7C1AC9D4EF2B93E3079E10255F
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 8e2cc55a813b5bd1a3067b3a8ab52457c23c20aad72d32d35cdf9e98017eaaed
MD5 f4537280891f114afccf182c483f9a5b
SHA1 48f2a6e9f113ee27ba66f1e58355aed5fc99a5f0
SHA512 a3972bd3437293f642d6197cb5f569cebf46b6597da680eb0d4e59220e65f71f685bfe205e441906334d092fa2568b245384a5069ee0d8a636175212816b3fa3
SSDEEP 192:sxZtSXRZyM/jK1Ml8Mkr/fCslNd+hIdpdwHW6+WNGYwKpI6aIgrJ:sxZtSX/Mr/fCslP+KWHbGrH9
TLSH
T10742E8116B34A97BCCCBD209FA557B53D6F9447292900E48AEFCCA1C04E6AED221781F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 567bc585fcb5aae03cab6e45acc7e6345c2c7954302df635a2df3909955f4efe
MD5 9cbefc3dec7173e5e8e5d536f2f36946
SHA1 6957743c47449112cefcf61e0b753b633079a519
SHA512 0e255c099b31168815835ec8117a56dc2a9e378de0199d2a74e16bde8444a93d850c5cc9bde15a2a7f3d251984aceefdb61923b4475741596b50711f90ca7549
SSDEEP 192:sxZtSXRZyM/jK1Ml8UQqkr/fCsP6d+hIdpHwHW6+WNGYwYq16aIg5oJ:sxZtSX/q5r/fCsPu+KQHbG1HK
TLSH
T18752E7116B34A97BCCDBD209FA457B53E6F5447291900E44AAFCCA1C05E7BED221782F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 30KB
SHA256 55e8c87ab2ca15622ef28e2241f37cc23c4b47fb4d171939c6c984c20e0cfeab
MD5 37ec85e917b99e1c83abc1f99b70a2a2
SHA1 30989ebdb6ad9ba4ebe59ef884037d7a0457b831
SHA512 9e3e5c75a8e06ee3a56f0e0bdcff7ae116cbde91c48b7e94cfba7b291ae699ffaedfb81476378a4d33d66e2cbc3676cab71ef6762a8ffa6309c050c7e7a63c42
SSDEEP 768:dW4jeXmWvmKLE8F1+UoAYDCx9Tuqh0VfUC9xbog/OVhPLlrZ+dSrohEciaR:dW4jeXmWvmKLEu1jacPLZQdJ9T
TLSH
T192D20A3B284CCB7E4F844E5CEC26AE976ED801CB6A584D5447FA894C03C77EB512B49B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 8410f25ac5225ea92bcfad83e45f692dea3af8665a4c359762a655ee98809580
MD5 beaac35d46e5bfcdfcb587d666a82290
SHA1 a9072d383600854e50fc877ac4611ce7fd7ec9f5
SHA512 4943ed2e225ab89b30e8e9bddbe366d27552cab160832bddc166eb29d2bb6147506225f54f63e5e3ade4226ce899698457238cc2ee8b47dd972cb8b4acdaff0c
SSDEEP 48:KMUIjKJSUjyxEIHK1+cVAIDKZi0nyyohMYKmykCH:KMUAKJSayEQK1+eAgKZimTohMYKmykCH
TLSH
T1469123227BBD02017D3E250882E4972B9E6675D3355CF42B3BA940B64EA7E104EFDDC9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig~RFe59455c.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig~RFe59455c.TMP
Size 3KB
SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
MD5 904e6e94a1d46374c8630cfd86cc729f
SHA1 e1d9c3f7813878acc6510d48d95b2bf48b2e1a0d
SHA512 081e2a26252860ff8d8f7a9d0378ae56f0cc50574d13d2a121afdf74284963747ef874a4d73b1df7774cd8570972f4f513eefe0a0325fd088556d5b1ba946712
TLSH
T1DB815C4FCC0CBE77ABAB6A719A35D6B2F79131EA94518A977F8C444EE3050ED0242E50
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 1a256f645a9c3c05ee57b7ed42cc6d11530426d27acb6ad03121a760a5b10725
MD5 77dd7ebf5da9f906317d34f338ac01a7
SHA1 38c1d544fb5ca1be1d0c4afb8ed8711812159d3f
SHA512 4ccf020b2b8cf13545dd3b970a159325f30a0e5fb0eb96d4cf6caafe7008339320d6d5bc67fc90ebed8cfd4714c8ae6e1d9b11c9547da1830b5f6edb3eb27aa0
SSDEEP 384:UZcIhsNAfW0j1suxVkf+68R+XGxJrEVFYivAxog:Shb+skZEh8Yi4xP
TLSH
T19D828E3149B8AC3B58E2E280F54735179FF4502796C9AF90D6FCAF2C00DAAAD1317C22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 21KB
SHA256 23d3d72ea6fd98bcd915950c0dd1a2dbd0834730729cad83f7a7c1b0ef7c9d31
MD5 37ebda50a79cf575feeb25116bbb1889
SHA1 6350ddcf802e81fb3635c789dda251e8289d69c2
SHA512 e204ff0c857ef6b3174c50c382fdfe4f72c4153d21ae6bac2a574db3282a7513620be11d34a8ff23741b057c74024a8d5e7c90b4dd5c10689d88549d8e795d10
SSDEEP 384:giFiZcIJsNAB8TUNTUlIln0j1suxVkf+68R+XGxJrEHFYivAxog:7FQJ/wgs+skZEhQYi4xP
TLSH
T1FBA25B3349A8D87B6DA6AB84F94A31139FF45067D5C9EA90E7EC9B2C009B5DD1307C21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 148c869a8c9cf985854dc77800daf1ebc4df714b9a9a69b5a4113670b41b805c
MD5 4c0e1595fd71411a47ec604188d9a1ce
SHA1 43b03e13f1afcb53c0a0d657d34e0fca042369fc
SHA512 2bd3a016e6f2072c99f7b0eb6199445e9e580d342951ca1415b03705a818ab0e637670497d030f0b6360235727051c0dad0dca87953f53b3f78cb8af60e5e1db
SSDEEP 384:aZcIhsNAfn0j1suxVkf+68R+XGxJrEVFYivAxog:YhM+skZEh8Yi4xP
TLSH
T16D828F3159B9AC3B58E2E280F54735179FF4502796C9AF90D6FC9F2D00DAAAD1317C22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 9131b325e7f6e1fc7a6f2d98f53803456c168fe316a9bd5672390c6f84100e15
MD5 eaa9a51e18a2c351fe9add344cb7daa8
SHA1 3c97be873ef7db1c0dc5e085a735f226028760e5
SHA512 6cd75688163317e5881965d2cdbfa93eb0a3d67494db7422fd177bb36b22beb701a7f41bf21702b9c0bba479c6871ca4948ae8d8cc9f08f67738a1c125a940c0
SSDEEP 192:EON86hZ0QmiUyBbpc/+jVIjzorRV5wOZe3U6:EON86oWpu+68R02UU6
TLSH
T1CD02D835A87C6C7B8EE2AE45F48727135FE5212BA9A56F84D6E81F1C00C779C2307836
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 e8f3c97086d5cde9a0f7b4203b42562f97708f064da3da68d78be741b8c73cec
MD5 5600e9b3c762167360a93c9402a0e7b5
SHA1 4136e129cbdfa0ad7c85cc71b7f58f9cf713b940
SHA512 6fd3a0d624de70304fd5a37e908768be355c8db8826dc62e7a299b42f1d953b4b19df7f3c747b623bb960e832a7385e2103580686682c4a4828296b1a55f367e
SSDEEP 192:+ON0O6hZdQmiUyibkc/+jVIjzorR+XKFuSJrEP5cOqyqoU6:+ON0O6Pvku+68R+XGxJrEi9YU6
TLSH
T18312EB35A968AC6B5DD2B591F48731139FE51127EEC9BF94D6EC2F1C00DB66C130B822
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

b2663705-d8c6-4f90-b844-6ee10d4aeba6.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\b2663705-d8c6-4f90-b844-6ee10d4aeba6.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 e62ab095ceb0a64dce9f836b220c29ae9a1bc259ab20c06ce25e3dddb59bd5ac
MD5 d7f23258155119a850f092d0c2132adf
SHA1 c97d04c45c6bb52208fbcb46b8bc435430fb1ac4
SHA512 45f865af6c31f7e1f7bbc05bee284eddd9bfbd10573f4056fe747890d558cfb6e3028292b4819d884689820bd15864cadc4407e8202ff3b67f1d677c537953ff
TLSH
T1C6410959BAE91148B3B76F5A9BF6A86D887BB8732E06D45E10110D4F0A73F40CC61B37
MD5 SHA1 SHA512 TLSH

Submit Download