ec6c6fbe72d70697c051a7d18156c8b0eda817216ae4dd5c5ad6bdf4134b9d32

Analysis

max time kernel
148s
max time network
145s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
28/08/2026, 06:00

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
ec6c6fbe72d70697c051a7d18156c8b0eda817216ae4dd5c5ad6bdf4134b9d32.html
Size 9KB
Sample260828-gqde7stdlc
SHA256 ec6c6fbe72d70697c051a7d18156c8b0eda817216ae4dd5c5ad6bdf4134b9d32
MD5 bdb1689230515db4302075143b13185d
SHA1 7c3e1e797669747069b9c31b87785823accf8ab7
SHA512 82ee35b0efbeec517b0f8de06d8211246a5d53cfd35557bbd000f991540c641505c2a7187751d28cb9841772ac14a0b52ded7aae012c3bc7ed028f4a0cd45722
SSDEEP 192:e3+KUgJarzG0I8MiFmqvvYZQpJMmPJW2TtfyX:ohJaOOmloMmPJ1TtaX
TLSH
T1AE22A472A964DC324503C969B4E1FF1D30BFD32E83054E8CB6BC2556A7DBC450A309AE
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
516	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134323704186389488"	msedge.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-668679576-120646659-2289335452-1000\{518734EF-77BD-4E66-A335-3A9EB2819C86}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4968	msedge.exe
4968	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
2804	msedge.exe
2804	msedge.exe
2804	msedge.exe
2804	msedge.exe
2804	msedge.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
2804	msedge.exe
2804	msedge.exe
2804	msedge.exe
2804	msedge.exe
2804	msedge.exe
2804	msedge.exe
2804	msedge.exe
2804	msedge.exe
2804	msedge.exe
2804	msedge.exe
2804	msedge.exe
2804	msedge.exe
2804	msedge.exe
2804	msedge.exe
2804	msedge.exe
2804	msedge.exe
2804	msedge.exe
2804	msedge.exe
2804	msedge.exe
2804	msedge.exe
2804	msedge.exe
2804	msedge.exe
2804	msedge.exe
2804	msedge.exe
2804	msedge.exe
2804	msedge.exe
2804	msedge.exe
2804	msedge.exe
2804	msedge.exe
2804	msedge.exe
2804	msedge.exe
2804	msedge.exe
2804	msedge.exe
2804	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
2804	msedge.exe
2804	msedge.exe
2804	msedge.exe
2804	msedge.exe
2804	msedge.exe
2804	msedge.exe
2804	msedge.exe
2804	msedge.exe
2804	msedge.exe
2804	msedge.exe
2804	msedge.exe
2804	msedge.exe
2804	msedge.exe
2804	msedge.exe
2804	msedge.exe
2804	msedge.exe
2804	msedge.exe
2804	msedge.exe
2804	msedge.exe
2804	msedge.exe
2804	msedge.exe
2804	msedge.exe
2804	msedge.exe
2804	msedge.exe
2804	msedge.exe
2804	msedge.exe
2804	msedge.exe
2804	msedge.exe
2804	msedge.exe
2804	msedge.exe
2804	msedge.exe
2804	msedge.exe

Suspicious use of WriteProcessMemory 30 IoCs

description	pid	Process	procid_target
PID 2804 wrote to memory of 4328	2804	msedge.exe	88
PID 2804 wrote to memory of 516	2804	msedge.exe	89
PID 2804 wrote to memory of 2484	2804	msedge.exe	90
PID 2804 wrote to memory of 2484	2804	msedge.exe	90
PID 2804 wrote to memory of 2484	2804	msedge.exe	90
PID 2804 wrote to memory of 4920	2804	msedge.exe	92
PID 2804 wrote to memory of 4920	2804	msedge.exe	92
PID 2804 wrote to memory of 1184	2804	msedge.exe	93
PID 2804 wrote to memory of 3696	2804	msedge.exe	94
PID 2804 wrote to memory of 1184	2804	msedge.exe	93
PID 2804 wrote to memory of 1184	2804	msedge.exe	93
PID 2804 wrote to memory of 3696	2804	msedge.exe	94
PID 2804 wrote to memory of 3696	2804	msedge.exe	94
PID 2804 wrote to memory of 1064	2804	msedge.exe	95
PID 2804 wrote to memory of 1064	2804	msedge.exe	95
PID 2804 wrote to memory of 1064	2804	msedge.exe	95
PID 2804 wrote to memory of 1980	2804	msedge.exe	96
PID 2804 wrote to memory of 1980	2804	msedge.exe	96
PID 2804 wrote to memory of 1980	2804	msedge.exe	96
PID 2804 wrote to memory of 2168	2804	msedge.exe	99
PID 2804 wrote to memory of 2168	2804	msedge.exe	99
PID 2804 wrote to memory of 3500	2804	msedge.exe	100
PID 2804 wrote to memory of 3500	2804	msedge.exe	100
PID 2804 wrote to memory of 3848	2804	msedge.exe	102
PID 2804 wrote to memory of 4320	2804	msedge.exe	112
PID 2804 wrote to memory of 1720	2804	msedge.exe	113
PID 2804 wrote to memory of 2696	2804	msedge.exe	114
PID 2804 wrote to memory of 2552	2804	msedge.exe	116
PID 2804 wrote to memory of 2552	2804	msedge.exe	116
PID 2804 wrote to memory of 4968	2804	msedge.exe	117

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument C:\Users\Admin\AppData\Local\Temp\ec6c6fbe72d70697c051a7d18156c8b0eda817216ae4dd5c5ad6bdf4134b9d32.html
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2804
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x248,0x7ffabfaec188,0x7ffabfaec194,0x7ffabfaec1a0
  2⤵
  PID:4328
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1944,i,7927329142837839046,8816866545061653900,524288 --field-trial-handle=2348,i,7749801386242769476,51281198278305655,262144 --variations-seed-version --mojo-platform-channel-handle=2460 /prefetch:3
  2⤵
  - System Time Discovery
  PID:516
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1640,i,7353275817591508231,15921194942097986676,262144 --field-trial-handle=2348,i,7749801386242769476,51281198278305655,262144 --variations-seed-version --mojo-platform-channel-handle=2340 /prefetch:2
  2⤵
  PID:2484
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2484,i,6330610211997423790,6183490342053303686,524288 --field-trial-handle=2348,i,7749801386242769476,51281198278305655,262144 --variations-seed-version --mojo-platform-channel-handle=2544 /prefetch:8
  2⤵
  PID:4920
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3416,i,16038924338884473365,13609760645444552639,2097152 --field-trial-handle=2348,i,7749801386242769476,51281198278305655,262144 --variations-seed-version --mojo-platform-channel-handle=3492 /prefetch:1
  2⤵
  PID:1184
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3436,i,11511935272658004560,3728288268988005171,2097152 --field-trial-handle=2348,i,7749801386242769476,51281198278305655,262144 --variations-seed-version --mojo-platform-channel-handle=3496 /prefetch:1
  2⤵
  PID:3696
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4156,i,18226016435108258365,5455601559849550741,2097152 --field-trial-handle=2348,i,7749801386242769476,51281198278305655,262144 --variations-seed-version --mojo-platform-channel-handle=4188 /prefetch:1
  2⤵
  PID:1064
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4168,i,4505609632643412078,8057950103194686332,2097152 --field-trial-handle=2348,i,7749801386242769476,51281198278305655,262144 --variations-seed-version --mojo-platform-channel-handle=4192 /prefetch:2
  2⤵
  PID:1980
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5012,i,11984563053016738888,3193088353744710196,524288 --field-trial-handle=2348,i,7749801386242769476,51281198278305655,262144 --variations-seed-version --mojo-platform-channel-handle=5128 /prefetch:8
  2⤵
  PID:2168
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5016,i,7706208297582870624,9572670535339338156,524288 --field-trial-handle=2348,i,7749801386242769476,51281198278305655,262144 --variations-seed-version --mojo-platform-channel-handle=5164 /prefetch:8
  2⤵
  PID:3500
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5860,i,15684823044367180956,10270284904351551912,524288 --field-trial-handle=2348,i,7749801386242769476,51281198278305655,262144 --variations-seed-version --mojo-platform-channel-handle=5876 /prefetch:8
  2⤵
  PID:3372
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5860,i,15684823044367180956,10270284904351551912,524288 --field-trial-handle=2348,i,7749801386242769476,51281198278305655,262144 --variations-seed-version --mojo-platform-channel-handle=5876 /prefetch:8
  2⤵
  PID:3848
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4176,i,13889607839887533822,15247747693773393221,524288 --field-trial-handle=2348,i,7749801386242769476,51281198278305655,262144 --variations-seed-version --mojo-platform-channel-handle=4784 /prefetch:8
  2⤵
  PID:4320
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4180,i,3364188417656413584,1096243331828139557,524288 --field-trial-handle=2348,i,7749801386242769476,51281198278305655,262144 --variations-seed-version --mojo-platform-channel-handle=3404 /prefetch:8
  2⤵
  PID:1720
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4192,i,3555529872897368929,13611148885717313408,524288 --field-trial-handle=2348,i,7749801386242769476,51281198278305655,262144 --variations-seed-version --mojo-platform-channel-handle=4748 /prefetch:8
  2⤵
  PID:2696
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4232,i,12373024195690911683,15120309501833290403,524288 --field-trial-handle=2348,i,7749801386242769476,51281198278305655,262144 --variations-seed-version --mojo-platform-channel-handle=5084 /prefetch:8
  2⤵
  PID:2552
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6128,i,14026343079933184456,9079075311137701416,262144 --field-trial-handle=2348,i,7749801386242769476,51281198278305655,262144 --variations-seed-version --mojo-platform-channel-handle=6160 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4968

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:4048

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

blocklist

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\blocklist
Size 105KB
SHA256 bd5dff6b6a2953b678276fe774acb1020dcf956eee918258c4fbcebd9799de50
MD5 ad9e9cc59d40b3c4a865c23e526c194b
SHA1 ec6e5c23153f46461256dc2ee3316df628e2eda9
SHA512 781d6d2d74c84caa1d22367f03cb2eef3a2125624c47277182248dc2b092992ad8756b1ea9759b2d56ee2b90c008cd691688382416e421209d33f546892f8550
SSDEEP 1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P74:fwUQC5VwBIiElEd2K57P74
TLSH
T14FB3B931457E36BF26E93EE828CF1511B84F3912664895D4ABE1FE2C4845E68633CEF4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CrashpadMetrics-active.pma

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\CrashpadMetrics-active.pma
Size 16KB
SHA256 814d47aad78c212b52568b9c7b58d242899d490d3afebce66181cae50c880df5
MD5 8c7cdfea4284ba987d295d82a9c7ddd6
SHA1 7d1a3a66f2d64a383b230196ba89a263ce7ee957
SHA512 59c8229e834c944265aed4131c79f41f9f940a48651b9fb18800cef5bae36d17c7fd5880120c6fee8ce22a157b65bc63846b65765bc4dc86e15926dcce400d0d
SSDEEP 12:sf9iXhV0xoUZxCe+JKlkQuMRxCb8TXuYJ0IJpPK6BsyW1inPiz:U9iRqxoUZxWMk8xVTeYWI31BtXP
TLSH
T105724C85B34498FFC8835E7189BD27903774F6DF1F02866B6A6A760E2E271C84F44224
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 1c8e6fcbb66aba64fe595f222fc4117e00e82ccdc0eef2100a1b4f7babb04f87
MD5 398d1e7948d46a763209c466fdacd0fb
SHA1 b26f2c32bc106089a59ce779d792beaba59f92bf
SHA512 a0bbf31d803e7333d004f03de9c261732d00cceb5d82dd64b5f0decf8adc8b840891187c72bb21cce83873e6d4dd2fab89d4c7efa320afe2ef3589678dcb1424
TLSH
T1B6D080277A196004F3964175A483D7061319956129575711F310C44CA9775D553C11C2
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 5d2c4e39ddbeb0ac61628bae04f1ac5787600ec893b0e230d1a84d61470771a9
MD5 cd6e704306442404371caebfec7f5b29
SHA1 e4beab8b7820af3633bf7c75a5498a958a95832e
SHA512 de66681a9245e8ece7d7e2ea2080251c395f2aeb8a885ac007eaf16f2ee3a3e36610d2afc17be964a038704371cedfbe4da91143ebed5adac20dbda97768d6e6
TLSH
T13AD080273A196404F7964175A483D7061319956129579712F310C44C99775D553C11C2
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 8001f2e0e92253eae4ed5ebef96419d9f40a1acb64b82a994fa049dd75b61847
MD5 bac29a9c7b9cf115746454556fc0de1e
SHA1 7f7b614f620f46d9e93b11a58a3af47100b883ca
SHA512 57546ef8e838d50c21cbd7b0e4077921509d257c9a3e7285cb9f7c003c299e077cbee76d7f1218d4e5e47a88457532fb2f307cb82c2e388941638304189e6507
TLSH
T100613B35016AA9ACD730123154E2115E70BDCFECFA37DE95287388F4DA06F7986E91C8
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe584cf2.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe584cf2.TMP
Size 3KB
SHA256 d7cad095183aad9f7e7cc7d3133f77f187e538a06e39309a019f79dc8474238f
MD5 39828be78fac5a4de8c6760458a3b3f7
SHA1 a5182ab6ba28c70382f3eb0ab3d3ac602166b255
SHA512 11f2b1d5f9863ab90f6b1648fc66618d3913f2884623d36057d02f2211a0f0464a6d863a80d5876532077ca213fc4339d7445cb201c7006581776664f64cb70e
TLSH
T138614B35016AA9ACE730113154E2125E74BDCFECF937DE95287388F4DA06F3986D91C8
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 949B
SHA256 32796aa170b8b85edafa3338a9eedd5e5b734447e79756103c473df28d9bf3c3
MD5 8a93c0ce344b39b17e8795ac0f389e77
SHA1 74b55cb3426996dc764b9ab002932f478dc5b68e
SHA512 e1fab0eee4745c660a14d28bcc1ab2f46e066bc15031148951dcfd6ea7c685345c577e32bb42d8728592df5559f8f67738a4fd5c234549ec684738226a52a967
TLSH
T1F1117DF3C3E5856FC91156F0AA24AE2BCE2D0605421C7C1589D4FF6793E3075E10195B
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 0b4fe341b42d54882cd12977bfb2a929c0cd51d70510fc4cc8eb484c18376b1d
MD5 70cef18f27e3eef3c7f9783f38bd85f9
SHA1 0c472244b933d3d19b56238ddf2c70c255ca1af0
SHA512 e1fb97758e165bb326fcfcca209607f44e57411744e04a3916b963a44a8d2edbb4b5d7e959c09ed2c486198c336f7be7e2ea49c336f5e74a90241d32bc1312cb
SSDEEP 192:sxZGRryM/jK1Ml8Mkx/fPs/exIdpdLHW6+WNGYCkFrSgIgrJ:sxZGpMx/fPs/e6xHbGGr9
TLSH
T17042D7117A34A977CCDBD21DFA517F53D6F91472A2900D44AAFCCA1C04E6AED221782F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 30133b1a71a01a4789d1dd53fdeb34a7bf9a3531c2edf4402aaa18d40ff7c628
MD5 b01f14446d177e61cafb5e2de5d4790a
SHA1 d53827ad669457bb87f075b8639f3bd8e701d987
SHA512 5fb4e1640d0596183aa370497b44c39f8592a52d2e5395a9f10ff66d02da4f49e38ba1dd96970916cfcc3f23ad87b59393dec0f6b022e893c588e99044019196
SSDEEP 192:sxZGRryM/jK1Ml8UQgkx/fPsVnxIdpHLHW6+WNGYCvOrSgIg5eJ:sxZGpqzx/fPsVn6rHbGgrU
TLSH
T1CB52D7167A349977CCDBD21DFA517F53D6F8587292900E44AAFCCA1C00E6AED221782F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 30KB
SHA256 2b47bb6af97ddfc9907fe33ee9065e6edfa772f19a86f9eedab9d5c6924c16dc
MD5 6391e0bd0f86a52563bdad66ba779336
SHA1 2447c2bf19a3212dfc360cdbef50f330bd384f12
SHA512 d0d76ab17a861ff68317a75aacc871ce3678eec74f2f20441df2feab7c96050b62980f059a4849769343852b6b82dae04ba0e1dd95b942b0c3cd90d06f5d26a6
SSDEEP 768:1a8bqn+WvSCt68F1+UoAYDCx9Tuqh0VfUC9xbog/OVnZLlRTKV2roR:1a8bqn+WvSCt6u1jaCZLbWVNR
TLSH
T1B5D20A3B280CCB7E4F845E5DEC26AF962DD801CB6B988D4447FA894C03C76EA511B5DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 1e8a1c6902a6d531422ddd3063e2c7e45fdb0255f3dced2efd0619d0756a8ec9
MD5 b9406762b344454e43675a7075d2fa69
SHA1 1bc97b8a4480ede7f305644e06c03ca0aabea1d7
SHA512 c2ab2ba1276aca27684e5dbf066bf591650f167483c2e95c9bd2b9f5129c5c4e276960a44818a805ebcc5e1173adb7eea9267258a5c97fc78ea9ba0ca9a22ca3
SSDEEP 96:KAVqKG0CWxS1RTL72JLk97R2KjT7X2nZxsHxni8YKhuV8:wd3/7/
TLSH
T18291214A35BA0212387D244DF293867B5F4239A33158E5AF7FB850A14F6AE111CFD8ED
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

d1d91437-b2f7-4356-bed5-11bdabe7406d.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\d1d91437-b2f7-4356-bed5-11bdabe7406d.tmp
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 32d9531212057356aa63854fa56340ab0a794e7b3ba25e40b6a07e90b1897ee7
MD5 3e30232f7c996ab644aecc1d1dc531c1
SHA1 b06c353177ebe7642112eb6192849db703dd6fb9
SHA512 f5ffe0c4a63245bf522cb7a63f29779507735096f6578d490753e4d5f7234231e334875085103355940107f537db672fcb1f9b3d0903d1fd86511432ad912904
SSDEEP 192:vONy6Db6QmiUyySHBa+jWOmBwR+sRgT7vU6:vONy6uyHBa+SOOp/U6
TLSH
T14502D73569686CBB9EB2AE49F88737275FD4103BDA966F44D6D85F0C00D764C230783A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 21KB
SHA256 293c1fedc2deabc6faf72abd6c2e1714fb3d2aad43019faa1319a1ffd52f5940
MD5 d57332c3bdcbb072dbc1f931836f3c53
SHA1 eebb3ae5bfb518a9f728dff2ba392ef2efcc3354
SHA512 8ea5900ffcd079843a3236dd60b202be8799ea80d6556a7831536c27133e2c136dd2fa9ac40c8c06b3ba2cc53538b42dd2f67e7db28f80bf17397fd69d0877c1
SSDEEP 384:GEiFiZcI9sNC8TUNTUlIlozc9Fq5+Ea+SOOqmE3p0X1puLRQIoc:GfFQ97wg6danOOqmE3psyLRQIT
TLSH
T105A26D736DA8897B6DF69B55F94B36078EB84073C5C9AA90E3CD9E0C00DB59C130BD26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 e548e2c779a85e1c80e91578dc6c716580299d9c585638814a0a7e41b8107e35
MD5 d2318ecde2481deeaa5f6f819e71227f
SHA1 84d2587ce2615fb2c557e8446b678b327be7a37a
SHA512 a1f2ad40299138862011bf0987016560cfb00effd6abe65a00096ecd05e309ee21eaa129897b81eebdc7421d7c8de7fe1b997e1acebded68b294bcd5fe9c3d23
SSDEEP 384:4ZcIhsN6xzc9Fq5+Ea+SOOqmNLp0X1puLRQIoc:GhZdanOOqmNLpsyLRQIT
TLSH
T1F5827D7279785D7B6DF2A245F54B36078EBC903396C96A80D6DDAF1C00EA59C130BC2B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 833d1319181665e8135729eed724dcef1f9d768ba1abcbe452a7df8aeeb7b223
MD5 f6eea42cd668cd357ab7a338504b5a90
SHA1 5e7fd75dbe952fafe939fd90bb6ea40582c81fc5
SHA512 4e5eded0bcca3b4b023bd76f616f1d164e9c83f919790f2324378ce5554d9c221f7c097e3512f036cd29834fcebbfd3e3185336504c1fe0d49042f30c169fb1f
SSDEEP 384:gZcIhsN6ozc9Fq5+Ea+SOOqmNLp0X1puLRQIoc:ehWdanOOqmNLpsyLRQIT
TLSH
T15B828E7279785D7B6CF2A245F54B36078EB8903396C96A80D6DDAF1C00EA59C130BD2B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 52f81db89e339c9f01fdaa41981e38149983ea276efc8e13c923be2931895384
MD5 e23f338f1fb257f2515c991902113cd9
SHA1 dcf98c9fa88bec3c19a75323e055f73c60bf33cc
SHA512 2b970d2999c5f940d265b6ea374a86ba58ef0efc191ce4d767b852bd3f9bf377602663b9236835bc57bd71ee210bd98dc14aa078458115fd6403423bc15bdcb0
SSDEEP 192:WONb6DbhQmiUyIS6Ba+jWOmBwR+QmZXNzVrqwlU6:WONb63O6Ba+SOOqmnpU6
TLSH
T11512093279689C775DE26558F88736139EE84127DA8A7F90D6CC1F1C00EF69C230E826
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\metadata.json
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 8e5a34e9bd899afe776a9f383732e48c5a3591b3e9601bdc5c59684c7ab95240
MD5 b23c565c540d7052d22d240d9c20a884
SHA1 ee848a01bc6c7316b03a5195f0984f03c061bddc
SHA512 989913b575aede9cb0059a2f52223cd8504d3e3811b342603d45480c34fc4a0eacf885a041ec5b291025104cb36afb498c460be39d6b5379d6ed9d9eecc5edc5
TLSH
T14241E75CB6EA1148B3B76E5A9BF6686D447BBD372E06D15E00010D4F0A26B40DD71737
MD5 SHA1 SHA512 TLSH

Submit Download