eccaacb56b82595598fdbba5419b5c504fd360f265210053dbc701ef31545994

Analysis

max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
24/08/2026, 18:20

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
rst.jiangxi.gov.cn-jxrsdtAssets-PDFJS-pdf.html
Size 797B
Sample260824-wy6jaasamd
SHA256 eccaacb56b82595598fdbba5419b5c504fd360f265210053dbc701ef31545994
MD5 3d583332927df85f18e6ce1c8ce1817c
SHA1 4b06e3b7c888e9e400383c6d173393185af9d873
SHA512 181090e72143964cfb4240b1c59638fc4ca160600f2a131e63670c06e0157f244a863b63a7c16b7ab297e17a675652bc1dd96d8231c1c509ee3987b3851f3b7d
TLSH
T11E01C06824F10C444577F1325FFFE379D5AA1013760192513C8C5217EF326206D637C5
MD5 SHA1 SHA512 TLSH

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
640	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134320692551196264"	msedge.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-540052884-2969440504-464782435-1000\{79991034-896B-4227-8EA2-EE038DB22D6D}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2304	msedge.exe
2304	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
4180	msedge.exe
4180	msedge.exe
4180	msedge.exe
4180	msedge.exe
4180	msedge.exe
4180	msedge.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
4180	msedge.exe
4180	msedge.exe
4180	msedge.exe
4180	msedge.exe
4180	msedge.exe
4180	msedge.exe
4180	msedge.exe
4180	msedge.exe
4180	msedge.exe
4180	msedge.exe
4180	msedge.exe
4180	msedge.exe
4180	msedge.exe
4180	msedge.exe
4180	msedge.exe
4180	msedge.exe
4180	msedge.exe
4180	msedge.exe
4180	msedge.exe
4180	msedge.exe
4180	msedge.exe
4180	msedge.exe
4180	msedge.exe
4180	msedge.exe
4180	msedge.exe
4180	msedge.exe
4180	msedge.exe
4180	msedge.exe
4180	msedge.exe
4180	msedge.exe
4180	msedge.exe
4180	msedge.exe
4180	msedge.exe
4180	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
4180	msedge.exe
4180	msedge.exe
4180	msedge.exe
4180	msedge.exe
4180	msedge.exe
4180	msedge.exe
4180	msedge.exe
4180	msedge.exe
4180	msedge.exe
4180	msedge.exe
4180	msedge.exe
4180	msedge.exe
4180	msedge.exe
4180	msedge.exe
4180	msedge.exe
4180	msedge.exe
4180	msedge.exe
4180	msedge.exe
4180	msedge.exe
4180	msedge.exe
4180	msedge.exe
4180	msedge.exe
4180	msedge.exe
4180	msedge.exe
4180	msedge.exe
4180	msedge.exe
4180	msedge.exe
4180	msedge.exe
4180	msedge.exe
4180	msedge.exe
4180	msedge.exe
4180	msedge.exe

Suspicious use of WriteProcessMemory 35 IoCs

description	pid	Process	procid_target
PID 4180 wrote to memory of 2716	4180	msedge.exe	85
PID 4180 wrote to memory of 640	4180	msedge.exe	86
PID 4180 wrote to memory of 1092	4180	msedge.exe	87
PID 4180 wrote to memory of 1092	4180	msedge.exe	87
PID 4180 wrote to memory of 1092	4180	msedge.exe	87
PID 4180 wrote to memory of 3032	4180	msedge.exe	89
PID 4180 wrote to memory of 3032	4180	msedge.exe	89
PID 4180 wrote to memory of 2376	4180	msedge.exe	91
PID 4180 wrote to memory of 4200	4180	msedge.exe	90
PID 4180 wrote to memory of 2376	4180	msedge.exe	91
PID 4180 wrote to memory of 2376	4180	msedge.exe	91
PID 4180 wrote to memory of 4200	4180	msedge.exe	90
PID 4180 wrote to memory of 4200	4180	msedge.exe	90
PID 4180 wrote to memory of 4492	4180	msedge.exe	92
PID 4180 wrote to memory of 4492	4180	msedge.exe	92
PID 4180 wrote to memory of 4492	4180	msedge.exe	92
PID 4180 wrote to memory of 2804	4180	msedge.exe	93
PID 4180 wrote to memory of 2804	4180	msedge.exe	93
PID 4180 wrote to memory of 2804	4180	msedge.exe	93
PID 4180 wrote to memory of 936	4180	msedge.exe	97
PID 4180 wrote to memory of 936	4180	msedge.exe	97
PID 4180 wrote to memory of 936	4180	msedge.exe	97
PID 4180 wrote to memory of 1592	4180	msedge.exe	98
PID 4180 wrote to memory of 1592	4180	msedge.exe	98
PID 4180 wrote to memory of 2420	4180	msedge.exe	99
PID 4180 wrote to memory of 2420	4180	msedge.exe	99
PID 4180 wrote to memory of 2488	4180	msedge.exe	101
PID 4180 wrote to memory of 1568	4180	msedge.exe	111
PID 4180 wrote to memory of 3764	4180	msedge.exe	112
PID 4180 wrote to memory of 2452	4180	msedge.exe	113
PID 4180 wrote to memory of 2084	4180	msedge.exe	114
PID 4180 wrote to memory of 2084	4180	msedge.exe	114
PID 4180 wrote to memory of 3384	4180	msedge.exe	115
PID 4180 wrote to memory of 3384	4180	msedge.exe	115
PID 4180 wrote to memory of 2304	4180	msedge.exe	118

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument C:\Users\Admin\AppData\Local\Temp\rst.jiangxi.gov.cn-jxrsdtAssets-PDFJS-pdf.html
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4180
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x264,0x7ffbecdfc188,0x7ffbecdfc194,0x7ffbecdfc1a0
  2⤵
  PID:2716
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1984,i,12004836761236109227,3810755652838497205,524288 --field-trial-handle=2284,i,11606945587130530475,11498227255232815931,262144 --variations-seed-version --mojo-platform-channel-handle=2328 /prefetch:3
  2⤵
  - System Time Discovery
  PID:640
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1764,i,8043745992945796909,236727037888591341,262144 --field-trial-handle=2284,i,11606945587130530475,11498227255232815931,262144 --variations-seed-version --mojo-platform-channel-handle=2280 /prefetch:2
  2⤵
  PID:1092
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2464,i,11026406918948199328,2449157277278639051,524288 --field-trial-handle=2284,i,11606945587130530475,11498227255232815931,262144 --variations-seed-version --mojo-platform-channel-handle=3024 /prefetch:8
  2⤵
  PID:3032
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3444,i,15945059933403303627,11875548219108084262,2097152 --field-trial-handle=2284,i,11606945587130530475,11498227255232815931,262144 --variations-seed-version --mojo-platform-channel-handle=3484 /prefetch:1
  2⤵
  PID:4200
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3460,i,17332062224292261436,5764569868473368832,2097152 --field-trial-handle=2284,i,11606945587130530475,11498227255232815931,262144 --variations-seed-version --mojo-platform-channel-handle=3496 /prefetch:1
  2⤵
  PID:2376
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4200,i,4510376713389523687,4016916794473068969,2097152 --field-trial-handle=2284,i,11606945587130530475,11498227255232815931,262144 --variations-seed-version --mojo-platform-channel-handle=4220 /prefetch:1
  2⤵
  PID:4492
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4268,i,7004066231846158016,10029380092707934691,2097152 --field-trial-handle=2284,i,11606945587130530475,11498227255232815931,262144 --variations-seed-version --mojo-platform-channel-handle=4276 /prefetch:2
  2⤵
  PID:2804
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=3536,i,16655138697930500064,11430944193645987330,2097152 --field-trial-handle=2284,i,11606945587130530475,11498227255232815931,262144 --variations-seed-version --mojo-platform-channel-handle=5128 /prefetch:1
  2⤵
  PID:936
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3628,i,2510304955694991321,13946265752556342075,524288 --field-trial-handle=2284,i,11606945587130530475,11498227255232815931,262144 --variations-seed-version --mojo-platform-channel-handle=3636 /prefetch:8
  2⤵
  PID:1592
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3616,i,3402455675172072837,17549624875064254525,524288 --field-trial-handle=2284,i,11606945587130530475,11498227255232815931,262144 --variations-seed-version --mojo-platform-channel-handle=3600 /prefetch:8
  2⤵
  PID:2420
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5812,i,11047106265292472275,17651749454845457425,524288 --field-trial-handle=2284,i,11606945587130530475,11498227255232815931,262144 --variations-seed-version --mojo-platform-channel-handle=5828 /prefetch:8
  2⤵
  PID:3248
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5812,i,11047106265292472275,17651749454845457425,524288 --field-trial-handle=2284,i,11606945587130530475,11498227255232815931,262144 --variations-seed-version --mojo-platform-channel-handle=5828 /prefetch:8
  2⤵
  PID:2488
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3564,i,9481259362521287617,7682798211562677145,524288 --field-trial-handle=2284,i,11606945587130530475,11498227255232815931,262144 --variations-seed-version --mojo-platform-channel-handle=3744 /prefetch:8
  2⤵
  PID:1568
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4472,i,9638088762957812040,13974199579289896252,524288 --field-trial-handle=2284,i,11606945587130530475,11498227255232815931,262144 --variations-seed-version --mojo-platform-channel-handle=4460 /prefetch:8
  2⤵
  PID:3764
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4456,i,17532515981424570231,3012930999610132063,524288 --field-trial-handle=2284,i,11606945587130530475,11498227255232815931,262144 --variations-seed-version --mojo-platform-channel-handle=4448 /prefetch:8
  2⤵
  PID:2452
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3656,i,2075116479324788130,15541929708109728954,524288 --field-trial-handle=2284,i,11606945587130530475,11498227255232815931,262144 --variations-seed-version --mojo-platform-channel-handle=2036 /prefetch:8
  2⤵
  PID:2084
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3576,i,15160130004166109005,4672226224017756622,524288 --field-trial-handle=2284,i,11606945587130530475,11498227255232815931,262144 --variations-seed-version --mojo-platform-channel-handle=5572 /prefetch:8
  2⤵
  PID:3384
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6084,i,14654112141053968396,7557074763805882685,262144 --field-trial-handle=2284,i,11606945587130530475,11498227255232815931,262144 --variations-seed-version --mojo-platform-channel-handle=756 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2304

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:5040

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

blocklist

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\blocklist
Size 105KB
SHA256 2bc7f3a4024d9673a2f7a098d546fe1f592a8aa0477eb259121fe80954c2f99d
MD5 403039b77d88ae3c8e79a108e60c95e6
SHA1 478b6a90cbd5967be9b36c911b5a2135e0b7199c
SHA512 fbec8c6863e6042041cea05b5efa69ca53b0340f3bee0900ef55602e442dca5b20c736b16589ad755fc44c45bb2c920ed0e29957fb7ab74fe05e101f104c82fb
SSDEEP 1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P7I:fwUQC5VwBIiElEd2K57P7I
TLSH
T1EEB3B931457E36BF26E93EE828CF1511B84F3912664895D4ABE1FE2C4845E68633CEF4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 0e2b315c59b1bfe8e547b0017a92548af7c81e08409e987a2628ad74667b4fec
MD5 7ab616f55807e9de5195a40c50f65e5b
SHA1 917a7797f800e5f30a1b9b8125127968246d7ce9
SHA512 da10f29803a072f42a2c102da0bee745cf1b1d47836e3d30e38b1e66beeb1abeaf2eb47b6c07b23682098f70fe2a4b29a0777eefa1380d0fff2509ff32d9b356
TLSH
T171D08023771D7182F35B41759053D7025A1680756463B701B325D41C9A740C9F28B1C2
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 b976ac8901ffd41ec02a04aa583bc9d11350f0f9f714fb92d3341bb0bde4629f
MD5 504ce80b644a85a7e68d85bd24169289
SHA1 1f740a722dfa97fc8fb30626b0e3d6217e4a9864
SHA512 9406464a4f6becd85591c12af8a97fdecfa2208649138f347fb50d3e28f1583adec061050924fa0405e46eb75af7e299e6564c2ed039db9d82c50326da32a3c5
TLSH
T19ED08023371D7582F75B41759053D7025A1680756463F701B325D41C9A750C9F28B1C2
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 71ae1893992bb83203a621c2b301faaef168e49945068fe71b3a885892e3491d
MD5 d21511e2e0241f0f64c313ce6f7346b6
SHA1 25461c154b3762d6d02932cbaf6fe0417a2e8349
SHA512 298f341d0253f6950208386892c380569c9ee0b169e23aa42b4d6248e2605ff4314399b1ceb310e11981b90f9b94f437b875cbf2378669917665dfcb863c3030
TLSH
T1BF71A2BB410287AFDB2DA2FD60DE71503C70A4D9F9335D569E5047363917B0142CEA88
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe58465b.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe58465b.TMP
Size 3KB
SHA256 aae4717891fbfb2724b2ccbb6bace1c066e0547d2845a31570d5b3f822eeb44e
MD5 82b7e430a18f76bab4d540a1275604f6
SHA1 952e82679609a8b77ff511f37c94369729ad051d
SHA512 f3297283d129dae574ea51c6dd1931766b2227496e49bb7950e5834cea4b607c3f029bcd255061b857a17904c96938504ff6ee6fd2debc7f37bfc8eb7d5c6207
TLSH
T1ED71A2BB410287AFDB2DA2FD64DE71503C70B4D9F9335D569E5047363917B0142CE688
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 949B
SHA256 d4c6126a73885ba171978adc71e26178f2e1be2cc3c025b6b6688d0696d08f7a
MD5 c29a3391b06f3996752e8696ee0102fa
SHA1 1c1b647ecc31b84a07ea66c654cfc95ac87f48dd
SHA512 b9440fbff4bf10630eaa3e9a7816be91d60c12185a52c8ca0fd51571c9532d4c61ba0f44249fa5e19b1d5907feb423536064c1f7bfa804f970fa03adaeb3d454
TLSH
T1C3117DF3C7D5C56ECD0156F06A24AE1BCE1D0505421C7C1A85D4EF27D7E34B5E10155B
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 5532a5778c732f7ca524660658ac5ad57b1de1e87453bd4132198171007614ce
MD5 6db957bf69beb61c64876d48a74cbb69
SHA1 051dcbebc4d25291353af04ced81e2f378cc6240
SHA512 fdd14f0c815660c76cd7fd076f75dabc0fbae763a894e05a6261a0bc99f5b05693574b55e250026b3d5cb224e6488590e948cf7b69d4cbd68f15cccd46ab7f8f
SSDEEP 192:sxZeR6yM/jK1Ml8MkR/fLsEbNZdIdpdaHW6+WNGYIkoX+eIgrJ:sxZegMR/fLsExZe4HbGfp9
TLSH
T16F42D711AB34697BCCDBD309FA557F53D6F8147292901E44A9FCDA1C04E6AEC221781F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 fd49c8c5f3a240c06d1581696900633354f73cb37af8d96241d49c90c5413bba
MD5 c4cd7f8609b56c5a9c316d49807bcd00
SHA1 a996615c83ba8d0a43afebde3efb2eceeda210f0
SHA512 fd7c37eaf3de5f18c83d7faf7e47ade9ae63ea59fa2db933b3c1a7761652967cb4d0ec7459bee8fde16cfeb6c769dc9332ab38d3f27b5df4019736f12925cb7c
SSDEEP 192:sxZeR6yM/jK1Ml8UQNkR/fLsxbNSdIdpHaHW6+WNGYIHULX+eIg5/J:sxZegqmR/fLsxxSe6HbGVwp3
TLSH
T11652E812AA349A77CCDBD20CFA55BF53D6F8147292901E44A9FCCA1C04E6ADC221782F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 30KB
SHA256 96be393d227be97183aa7338a326ba95ba2ef464420523b87eabb8ccde780f97
MD5 2ba0b10f7b990510f403f7afb70ea74a
SHA1 28044ae82c426b9b7f6948ec496c653fac4738e6
SHA512 8ce1d78a3ff0ca305efab0f5aede8cd48576234ca92caf4fa935579096577541f2c838bf85df229c0902d540b79737d301bf63bc42bd2c72b35ea12c5d7d9a3b
SSDEEP 768:uksqxXlWvJD6T8F1+UoAYDCx9Tuqh0VfUC9xbog/OVk4Ll6AR9NroWMP:uksqxXlWvJD6Tu1ja54LAs9mWy
TLSH
T17ED21B3B694CCB7E4F840E5CEC266FD76ED801CBA6988D5447FA890C03CB2EA51165DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 9ea11dfdaa497e3cce9fe9bb9eabc4ccf19827b4e746b5d152ee5d48a6f8c643
MD5 e330ae49c1d2aa73fe0a50f6b8d48906
SHA1 7b48794679b4db82df17a3abf36eb4a55e1e69ba
SHA512 38bb4a7be5c74fcf597c9f2534847f4e0faed7835d2dcfe8d16d7637f0d249127ac803b3276bf5fd895ff8ca0fde8a63cae6cad5c4c719f1b6d1055d404b2fa7
SSDEEP 48:KPYNs4iCiac6vpI9IaKGveOaS4K7H2oTyZ+I/Kjiojy5EIfKdmsSG1imckJ:KYbaKYIK6+EKji2qEAKdmVG1imckJ
TLSH
T15891164A363A0212383D2958B2A786371F423A63701CA46F3FB940E55E6AF121CFDDDD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 61293fb40b851bebd2f2f70cda51ceec4135c87ced300bc084627f665ea8e8b3
MD5 78c89899dd9551f28700dde64a827e8c
SHA1 33b602ac26858ff05a29bd011d5d6c74c1724618
SHA512 72c20cecde447c5220117a4498d6fc663696ff61eca7f026bd7480f5a9e60e2ef591550be253c470794c74b9b10dfbb0d3620c3f49b5a444db25923f0b12c14f
SSDEEP 384:GZcIhsNZUKGQbn2UVRN0OKq976iv+utor:UhHNqH0OB976i2utQ
TLSH
T1DD827D759C349C779AF6D244F94B35075FB89037A6C96E8091EDAF1C01DDA98230FC2A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 e2ad54b2fb00e8bf62137868207f76cd2944bf3a7930a91e7137e267e86337d1
MD5 c298a0d105555492fac553bc6a545d5e
SHA1 c40ecdbe55649c763313b4c921450a357de8229a
SHA512 f891fdf8e1c306539c517e2a0d3aa9d302cabcb515758cdd37e2363e764c3ae5d1e4d344962059949751fcab59834b11cd701d421f81cbfb9515cf82082e0cca
SSDEEP 384:aZcIhsNZU6GQbn2UVRN0OKq976iv+utor:YhXNqH0OB976i2utQ
TLSH
T118827D759C349C779AF6E244F94B350B5FB89037A6C96E8091EDAF1C01DDA98230FC26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 21KB
SHA256 72dcac2354255abf8fb688cebbb0b1351a2d9f46358f2001cf8ce508f1a4f3c9
MD5 d559d94cbe41f066fbf3dc99f0eaa67a
SHA1 3762ce6f3490edff775bc88ad0f29997531a5fb6
SHA512 024f0e457b293b8f12c95158c969a2b9c0c0e7a993d172cf8562c446e64f8c7857afab608350cb240e203b3af4238419ee1c24f4755d378642ef6af11a4364d9
SSDEEP 384:bFiZcIXsN68TUNTUlIl6GQbn2UVRN0OKq9C6iv+utor:bFQXPwgnNqH0OB9C6i2utQ
TLSH
T167A25B724D648D7BAEF69B44F94A36078FB84077D6C9BA9092DC9F1C01DA59C130BC25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 45f7eebf7763214c2c37f6f7a2eaca503f4db1e11d4d29ad0410efec0e97ef2a
MD5 23f5f57f565d1af80b08d9a2812eee69
SHA1 4b9108a2b5811798fa171dc28413d99cb833a02d
SHA512 c3e3fc73a7f3f74f1245fc2b047dd5f5515f43795b1869f3ee9c6c3fa33c88453c65ddd9b8619c4b81a5b0abb120ec4b913d920d8ed5e9686ae87c49c8bda5b5
SSDEEP 192:tONr6JkRtQmiUyQcW+RN0OmheR2h3VR5U6:tONr6UrkW+RN0OKFdU6
TLSH
T1C702FA35AD381C7B9EF36E09B94727175FA4207BE9952F80D6E81F0C01D765C1346836
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 b5373bb69044bcea9e3971dc004bf923791b0bfa10611edd8087179723bdab59
MD5 f985906260179ca62c2a20cc5553f8cf
SHA1 ad1334fb775b7dbe41b4e266bdeb75c81f17ba9e
SHA512 3fe57b679d7143a9dec6c412695867f76a3624d57064ae72d58e9dc53b91e5cb9e1d60dbb493053d4223d6b64950d1f248d9b3385f78bef2a59e19325ab56fab
SSDEEP 192:zONT6JkRBQmiUy+c0+RN0OmheRnX9NVcDqU+U6:zONT6Uf+0+RN0OKq9A6U6
TLSH
T1B7120936A9289C779EE36944F48732175FA95137EA897F80D5DC2F0C02DB69C234E826
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e8c48f7a-261d-47d6-8952-905b4a767419.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\e8c48f7a-261d-47d6-8952-905b4a767419.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 4221054a619bc1350da0b571aed32bc62f3c567c578daeaacda9d73958cb3e0c
MD5 9c02a52b98a901523b63a23a66bb95e4
SHA1 6a3edd140f0cd6bb43a671a06b5c367aafc13ea4
SHA512 4ca34fc97cc85493c3c802da80dadfda8bb8dede27ea730056033d0077a4633d8a1325d4a6c4bbdedd93be49b1eb6e477f8f2ae48e78a5ca64a7cdc522355e6c
TLSH
T175410659B6F91149B3B77E5A9BF7686E447EB9332E06949E00110E4F0633A40C961737
MD5 SHA1 SHA512 TLSH

Submit Download