6a15bf1f9a64be44e5ab20621fa99059bad38641f0b0f10a4a6203623255e605

Analysis

max time kernel
148s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
28/08/2026, 18:25

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
.html
Size 3KB
Sample260828-w25fdsdk21
SHA256 6a15bf1f9a64be44e5ab20621fa99059bad38641f0b0f10a4a6203623255e605
MD5 3064e5c8a67e263a6bd331a837df4c9c
SHA1 62391c970a7ad9b3541ffafd9ef98afa365a468e
SHA512 e956df5c42ee8ee148e2d180ed1487ef103ae7a76ede1969e05fa8c507860ec3c297010c42a1e4e73933129cb06d7b17bf2f4dc2c8917ffcb1b395c5fd46947a
TLSH
T14C8188A7A8044406276083B1617FF40CEAE6416BD550E852F9BC449D87DCEE745B3F5E
MD5 SHA1 SHA512 TLSH

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
1884	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134324152636072888"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-204488895-2999877624-296153668-1000\{D776AE0A-04C4-4531-BF24-31DD54D3064F}	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3168	msedge.exe
3168	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
4824	msedge.exe
4824	msedge.exe
4824	msedge.exe
4824	msedge.exe
4824	msedge.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
4824	msedge.exe
4824	msedge.exe
4824	msedge.exe
4824	msedge.exe
4824	msedge.exe
4824	msedge.exe
4824	msedge.exe
4824	msedge.exe
4824	msedge.exe
4824	msedge.exe
4824	msedge.exe
4824	msedge.exe
4824	msedge.exe
4824	msedge.exe
4824	msedge.exe
4824	msedge.exe
4824	msedge.exe
4824	msedge.exe
4824	msedge.exe
4824	msedge.exe
4824	msedge.exe
4824	msedge.exe
4824	msedge.exe
4824	msedge.exe
4824	msedge.exe
4824	msedge.exe
4824	msedge.exe
4824	msedge.exe
4824	msedge.exe
4824	msedge.exe
4824	msedge.exe
4824	msedge.exe
4824	msedge.exe
4824	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
4824	msedge.exe
4824	msedge.exe
4824	msedge.exe
4824	msedge.exe
4824	msedge.exe
4824	msedge.exe
4824	msedge.exe
4824	msedge.exe
4824	msedge.exe
4824	msedge.exe
4824	msedge.exe
4824	msedge.exe
4824	msedge.exe
4824	msedge.exe
4824	msedge.exe
4824	msedge.exe
4824	msedge.exe
4824	msedge.exe
4824	msedge.exe
4824	msedge.exe
4824	msedge.exe
4824	msedge.exe
4824	msedge.exe
4824	msedge.exe
4824	msedge.exe
4824	msedge.exe
4824	msedge.exe
4824	msedge.exe
4824	msedge.exe
4824	msedge.exe
4824	msedge.exe
4824	msedge.exe

Suspicious use of WriteProcessMemory 30 IoCs

description	pid	Process	procid_target
PID 4824 wrote to memory of 2788	4824	msedge.exe	86
PID 4824 wrote to memory of 1884	4824	msedge.exe	87
PID 4824 wrote to memory of 4816	4824	msedge.exe	88
PID 4824 wrote to memory of 4816	4824	msedge.exe	88
PID 4824 wrote to memory of 4816	4824	msedge.exe	88
PID 4824 wrote to memory of 2128	4824	msedge.exe	90
PID 4824 wrote to memory of 2128	4824	msedge.exe	90
PID 4824 wrote to memory of 4796	4824	msedge.exe	91
PID 4824 wrote to memory of 4796	4824	msedge.exe	91
PID 4824 wrote to memory of 4796	4824	msedge.exe	91
PID 4824 wrote to memory of 856	4824	msedge.exe	92
PID 4824 wrote to memory of 856	4824	msedge.exe	92
PID 4824 wrote to memory of 856	4824	msedge.exe	92
PID 4824 wrote to memory of 832	4824	msedge.exe	93
PID 4824 wrote to memory of 832	4824	msedge.exe	93
PID 4824 wrote to memory of 832	4824	msedge.exe	93
PID 4824 wrote to memory of 4476	4824	msedge.exe	94
PID 4824 wrote to memory of 4476	4824	msedge.exe	94
PID 4824 wrote to memory of 4476	4824	msedge.exe	94
PID 4824 wrote to memory of 4072	4824	msedge.exe	98
PID 4824 wrote to memory of 4072	4824	msedge.exe	98
PID 4824 wrote to memory of 2276	4824	msedge.exe	99
PID 4824 wrote to memory of 2276	4824	msedge.exe	99
PID 4824 wrote to memory of 636	4824	msedge.exe	101
PID 4824 wrote to memory of 3720	4824	msedge.exe	108
PID 4824 wrote to memory of 4800	4824	msedge.exe	109
PID 4824 wrote to memory of 464	4824	msedge.exe	110
PID 4824 wrote to memory of 2668	4824	msedge.exe	120
PID 4824 wrote to memory of 2668	4824	msedge.exe	120
PID 4824 wrote to memory of 3168	4824	msedge.exe	121

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument C:\Users\Admin\AppData\Local\Temp\.html
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4824
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x260,0x7ffd51ddc188,0x7ffd51ddc194,0x7ffd51ddc1a0
  2⤵
  PID:2788
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1924,i,4960434981483333564,8988207398781738313,524288 --field-trial-handle=2444,i,1134334016805642575,3285954664851016374,262144 --variations-seed-version --mojo-platform-channel-handle=2488 /prefetch:3
  2⤵
  - System Time Discovery
  PID:1884
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1628,i,11351960619233364058,6811547117749288913,262144 --field-trial-handle=2444,i,1134334016805642575,3285954664851016374,262144 --variations-seed-version --mojo-platform-channel-handle=2440 /prefetch:2
  2⤵
  PID:4816
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2500,i,10675718856078422191,11790690934203724935,524288 --field-trial-handle=2444,i,1134334016805642575,3285954664851016374,262144 --variations-seed-version --mojo-platform-channel-handle=3056 /prefetch:8
  2⤵
  PID:2128
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3452,i,10256789533799561718,4143630710129573183,2097152 --field-trial-handle=2444,i,1134334016805642575,3285954664851016374,262144 --variations-seed-version --mojo-platform-channel-handle=3552 /prefetch:1
  2⤵
  PID:4796
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3432,i,1616192087640444919,1572989323943166621,2097152 --field-trial-handle=2444,i,1134334016805642575,3285954664851016374,262144 --variations-seed-version --mojo-platform-channel-handle=3476 /prefetch:1
  2⤵
  PID:856
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4168,i,10682611944367139861,544158383940776390,2097152 --field-trial-handle=2444,i,1134334016805642575,3285954664851016374,262144 --variations-seed-version --mojo-platform-channel-handle=4128 /prefetch:1
  2⤵
  PID:832
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4180,i,1065967397692291643,697556675956568363,2097152 --field-trial-handle=2444,i,1134334016805642575,3285954664851016374,262144 --variations-seed-version --mojo-platform-channel-handle=4212 /prefetch:2
  2⤵
  PID:4476
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5104,i,1558849487060657137,13668183307897350538,524288 --field-trial-handle=2444,i,1134334016805642575,3285954664851016374,262144 --variations-seed-version --mojo-platform-channel-handle=5128 /prefetch:8
  2⤵
  PID:4072
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5108,i,1830672450660482911,3242148744621694833,524288 --field-trial-handle=2444,i,1134334016805642575,3285954664851016374,262144 --variations-seed-version --mojo-platform-channel-handle=5168 /prefetch:8
  2⤵
  PID:2276
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5784,i,13349651874079011769,15665635495173936140,524288 --field-trial-handle=2444,i,1134334016805642575,3285954664851016374,262144 --variations-seed-version --mojo-platform-channel-handle=5780 /prefetch:8
  2⤵
  PID:2308
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5784,i,13349651874079011769,15665635495173936140,524288 --field-trial-handle=2444,i,1134334016805642575,3285954664851016374,262144 --variations-seed-version --mojo-platform-channel-handle=5780 /prefetch:8
  2⤵
  PID:636
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3948,i,17115885174956557967,7067599565170210867,524288 --field-trial-handle=2444,i,1134334016805642575,3285954664851016374,262144 --variations-seed-version --mojo-platform-channel-handle=5828 /prefetch:8
  2⤵
  PID:3720
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3888,i,9367968566509974498,8446217349515261460,524288 --field-trial-handle=2444,i,1134334016805642575,3285954664851016374,262144 --variations-seed-version --mojo-platform-channel-handle=5836 /prefetch:8
  2⤵
  PID:4800
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4192,i,16375025323661712507,17416023649841204619,524288 --field-trial-handle=2444,i,1134334016805642575,3285954664851016374,262144 --variations-seed-version --mojo-platform-channel-handle=4804 /prefetch:8
  2⤵
  PID:464
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2080,i,2786523088965827147,14554238561851684710,524288 --field-trial-handle=2444,i,1134334016805642575,3285954664851016374,262144 --variations-seed-version --mojo-platform-channel-handle=4816 /prefetch:8
  2⤵
  PID:2668
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6012,i,6607176247343115556,7187437289646668053,262144 --field-trial-handle=2444,i,1134334016805642575,3285954664851016374,262144 --variations-seed-version --mojo-platform-channel-handle=6180 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3168

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:4500

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

91511367-bd5f-470a-944e-8cea6d2b6132.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\91511367-bd5f-470a-944e-8cea6d2b6132.tmp
Size 17KB
SHA256 282ce2f893cfbad2c0ad775180fec09e4cbf4e74efa5fc8b252fa00e9a3c52b0
MD5 f6be79491bc3619735c54baac287d6ae
SHA1 8cc2da0ba30a7aea76d35c64e187675f01aa5ad6
SHA512 bdf17e2766d8222c1c7693e5d41e6fee5715c05d1092ffa9b00c02b6d8938ae7fb69238f0387c982e22c2c612e455a5337bd81b4fc9fe31558c021d7a2e5d90b
SSDEEP 384:riFwIsNw8TUNTUlIlurDfbkr/3dMjCEJrixx0X1puLFQr:GF/DwgCf+P6hixxsyLFQr
TLSH
T12D824B339CA8D93BADA6AA41F54E36039FF44177D6886A90F3DDAA0C01EB5DC130BC55
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

blocklist

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\blocklist
Size 105KB
SHA256 ae53e618032c667892ed21a0d220c217b0a8d7911b3dee86b08e6a49f9b5961f
MD5 f9f19468189111f8249d81621e4a102d
SHA1 fa68cce6f26f82bf96fb875ff427a4ef9e9673b2
SHA512 d53cb2328cd19d1ba8512d1ff3633af39c02eed400e5983853154f5b66c3341ed3d1103439b7c80316b2363de07a7530588d76f9e262920e057331d68d3f3bb7
SSDEEP 1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P7h:fwUQC5VwBIiElEd2K57P7h
TLSH
T18DB3B931457E36BF26E93EE828CF1511B84F3912664895D4ABE1FE2C4845E68633CEF4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 cd640af4b18734f838b65cd3f2b65e25dc669e7cc487a16f826240b353446af4
MD5 337b94f0014654439210355bd20e82dd
SHA1 26e4c8276331781253e2a807dd554b2ee3ad7e8e
SHA512 087107a51c83ccffad34c7d3f5423a0f231d30a9f78e9ed5db98eb770bada291f65c7b34d1e72284571b846a7acdf88b217ef4da25b7acff47964af1551b2e9b
TLSH
T1B6D012323B197041E71A8130E403C74017AE54B524864606A254C50D6DA90C592CB682
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 85f865adbe5e58c0596a4db9b9daa509b8e2bd087dbcc9a01a5a095a266757bc
MD5 29ddc94c4e214fd03f664130dd36edfe
SHA1 10dfd57508ad6ef16445956dc1ee4d8c2bffc4e3
SHA512 fa7477f3f8068f41dae4965a930de8ad11b234c1ccfcd17a84fb2bfe4c289beebc19be8d058f75ed01b6dbe7304af8270da91d31316fc94360f4fa750ab203bd
TLSH
T13AD012323B597441E71A8130E403C74017AE54B524868706A254C50D6DAA0C592CB682
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 8e4ec95d5d0cd0f4429a1a928cc94880ce77046aa4d26ae6dde7184c3e69ea0c
MD5 9b0f33ba61d5c0518172f36ead3c40a5
SHA1 9062ca19d7a17180939bdbd5877e570d553e1c20
SHA512 fdc0a4b3502537607ffc54580d8c2a3a5f162b0a41270e78219cbbc6f5cd68bc5b54a7653fdab49e3f31f02ed3a634df8a7755b5c583dd34bb68047974b86818
TLSH
T14B811E35028E0091C75EA2B9FFC10300F772A2EBFF97AD76C492A97C980375C850AC45
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5855eb.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe5855eb.TMP
Size 3KB
SHA256 19285e2a5aab7e058dae43325c9b6c95cc38d7667c2acc29c1e30d77d428c414
MD5 991d8fb4b33e134a1f0eeb9ca44f56a9
SHA1 d7266e33373befa080ddcf7e66a67f6cd0c07c52
SHA512 b740791e740f04d48bea513a75217a4c6700a67bc5b09fb5e109c85bc643567e160f82b00985782c9550d542188fce96e82b1cb73f446108c20d2b30fb695651
TLSH
T1EC812F35028E0091C75DA1B9FFC10700F772A2EBFF97AD76C492997C990775C894AC45
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 3KB
SHA256 8b66cd0031938cba3231abb84d18b0096d6a4dc9f524ea542676079cd843c10a
MD5 6693bc89f7c0d286b35ccfa1155db548
SHA1 6474e9825c29aca7d4af8f9d7e893b01b8eff60c
SHA512 14c31f775c3e732e944424198c94fc4c6e44ca0f715c5097ec52f6ebd2d644fdf7cf38d876725d85d57f9c2e46c187c150d81f62d1dfa89de915145d1c5204b7
TLSH
T16B7148BAC6D8476E891156F09F25A92BCD2E151A823C3C568DF4AF1B63E24B1E10129F
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 e7fa9d1f8dada0d1ad8cb5bac83c4c988b14eef667957adc1a55602055236d5c
MD5 a08062fea183194896a84e46f33956c9
SHA1 ffaefd2e3d81c23c384b67924fae6578a74f158d
SHA512 5864bde3b51c0be82a6efbee7743a6b34427acf9b730c7ad78724f40ec72a563717e4308b2d03412ef19e36b91aa049dc596eba62ee827b082793331825db7b4
SSDEEP 192:sxZ2RNyM/jK1Ml8MkA/fVsIuS9Idpd0HW6+WNGYzQnXQIgrJ:sxZ23MA/fVsIu3WHbGY9
TLSH
T1F342C6026B34A977CCDBD209FA51BF53D6F51572A2940E44A9FC8A1C04E7AED2207C1F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 09fd158bd5f408c213dff206df581bc1f5cef3c760662304a0dfda5098bd42d4
MD5 058502badbd990fc5e7e2479a0eabc12
SHA1 5f1c190f6e775ad61dbd8c85871b343bf386dc9a
SHA512 c78a3f2f5362d3c976cb73df73396047fed6fa240a0f1a29c97c26dfee1dd45f9e29face832fa77fe0a65015a8b843c0f13011b06a68de367911b41cef686600
SSDEEP 192:sxZ2RNyM/jK1Ml8UQOkA/fVsM5S9IdpH0HW6+WNGYzgOXQIg5OJ:sxZ23qlA/fVsM53UHbG34
TLSH
T17C52D712AA34A977CCDBD219FA41BF53D6F5557292940E44AAFCCA1C00E7AED2207C1F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 30KB
SHA256 621d06b3beaa5373e504961523582f4d96a5ae23a317ba0c20a862a924237011
MD5 84c36944dbb005d3a37ccc3a0ce5eee6
SHA1 03ac318f8398fa8cdbf78cc3b2be78ab335d0eea
SHA512 b40ec18d5e4e42e0cf1c98b51b1355436783f8bb7f02134efa302f181ee3463bebb63c6e9f59f0a718a8e96f7fce95d709b7f87baefe1dd30354fa233487c2fe
SSDEEP 768:f2W7kf0Wvqida8F1+UoAYDCx9Tuqh0VfUC9xbog/OVX5LlWYSj4roI2iHYg:f2W7kf0Wvqidau1jaa5LA3jDVg
TLSH
T1F0D20A3B680CCB7E4F840E5CEC266F976ED801CB66988D5487FA884C03CB6EA51175DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 07415eb803b47bbe3dd673cdeaf650aaac1d354785fad8cd24a44ebd564ddd42
MD5 80ccb215109e69feac5cbc7fa6747c63
SHA1 4e97682a0af7c2f3d72049cfef876f535a8e9343
SHA512 5a3e1651f93facd35526e7307eb9e5a983f8d9220e5770fb222689cf5307a8763bb604fb6cf5293e3269c708fbff2e2e8a5a7ec5b68f65feafc1e6d7a4010632
SSDEEP 48:KfSVOyIQA2aQL9IZy2KYTbaIfK/qA7yy0TwkaeykCehPIhckK4BQSkME0jBab1Il:KIbCKcba0K/qmOVGKmcF1OKo
TLSH
T1A2913E42747F46122CBE2D08A26685365E42319335A865FF3BB804A61F77E150DFEDDC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig~RFe58efe9.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig~RFe58efe9.TMP
Size 3KB
SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
MD5 904e6e94a1d46374c8630cfd86cc729f
SHA1 e1d9c3f7813878acc6510d48d95b2bf48b2e1a0d
SHA512 081e2a26252860ff8d8f7a9d0378ae56f0cc50574d13d2a121afdf74284963747ef874a4d73b1df7774cd8570972f4f513eefe0a0325fd088556d5b1ba946712
TLSH
T1DB815C4FCC0CBE77ABAB6A719A35D6B2F79131EA94518A977F8C444EE3050ED0242E50
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 14KB
SHA256 febc5a4ec71bfb37dc128239d56b480c001571581a35b9ed83f2796ab8ddaa28
MD5 dbfd508f9ca9c76c8c11606092541f1b
SHA1 b72e181e11200560c2761b2d146b39641591b311
SHA512 e770a9ec6b1c2ef009530d4d2d9f996e50a35d15d7d0ac6e82daef9d0b06450b4b7a4ad6df1bc2c689cee3c18dbd1fd4c5d8674b242fda7aa9a2d016368cb806
SSDEEP 192:uXLsNZ7QCDBBbH0QmiU1T1w4aGBPKnn+FdGN9Q8XFC1SJr1dNeq1Ld0X/dpuI9MW:IsNZ7rDfbkr/3dMjCEJr5xx0X1puLFQr
TLSH
T196625D366C796C3759A2A541F14B3A079FF84137A6C82F94F2EDAB1C01EF69D130B816
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 17KB
SHA256 088f416e3c2afb40fd1a3b4bf3d0aa2ab9acb3b092e1d63b9573899005af7973
MD5 a3fee2afb5f58e26622dd0fc36c77715
SHA1 847723340dab2cbf2db692c7683ff90c0473e882
SHA512 58b7068f709188e7740ddcc482eb7f1b7f7daa2e3c1421b00bc21399959e093d8cce413886d29125ca138263ab0e02919e58e1f8e34d9372ff0b49d04c149ff8
SSDEEP 384:riFwIsN78TUNTUlIlurDfbkr/3dMjCEJrixx0X1puLFQr:GF/GwgCf+P6hixxsyLFQr
TLSH
T1F6824B335CA8D93BADA6AA41F54E36039FF44177D6886A90F3DDAA1C01EB5DC130BC15
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 60da8b8319e89f4edaef8bf33263ca8596e376faed3e28b62ae11e141f5735f3
MD5 979c456a14cf33f80ea72916b9039694
SHA1 47f4a130fa757ad70cd828ef4024950c7cbaeda9
SHA512 de689bbcb9e11d3c0388503b27d9ecec4df87f011a8274010ed14f00e606069a16031418927a94322a6102b6a20c0cc76dbde8d25ee47bd35e7771a4f119f1cb
SSDEEP 192:MONt64BAQmiUy/17W5GBPKnn+FdGN9Q1aDZT8U6:MONt6eAUZWMdMRR8U6
TLSH
T12B02F835AC796C7B9EB2AE45F4863B176FD8113BE6D55B54E6E82B0C00D764C230382B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 14KB
SHA256 b1cdb8d82e8f1095b7f10f8b736d2324cce68b4bab4e98f4eb4f4d2985bbf0d9
MD5 3c98042e41aa9901d7b3cf5bc8c181db
SHA1 f78f164ffdfa9cd7b46720c592c63d909bad470a
SHA512 2c01d03bdf333713da165d7d4734d460d5f849eaaa1b8a5e0dbd1a998a1e8dc0774cc994a90234003426a1787773f735579392897ffc1cfaaf137340f219d87b
SSDEEP 192:u7LsNZuQCDBBbH0QmiU1T1w4aGBPKnn+FdGN9Q8XFC1SJr1dNeq1Ld0X/dpuI9MW:ssNZurDfbkr/3dMjCEJr5xx0X1puLFQr
TLSH
T1C6625D3668796C3759E2A541F14B3A079FF84137A6C82F94F2EDAB1C01EF69D130B816
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 ad4f22b7a81d2c4cb89e32ae25ad4abf15d0b92731225dafd15fec5eb7505bf3
MD5 decc6664a4447bf6086db1b2ff5fe416
SHA1 ef5cde77340e6ecd2573447db4387f8a9b1af267
SHA512 82d5eacb27305cbde40759d8a65737961577205b2ae905fb5212bd65b67da759e61d2b6ab3550b54bf915831b5248b9280849d942d6f2684c49991a599d3bbbe
SSDEEP 192:NONE64BeQmiUyO7d5GBPKnn+FdGN9Q8XFC1SJrkWweq1LdU6:NONE6ea3dMdMjCEJr6xxU6
TLSH
T184122B36AC786C3B5DA2B551F4873A035EE54137EAC96F90F6DC6B1C01EBA6C2307816
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 14KB
SHA256 396775ff1f172eb702be822880d7946ff85cd096effb75460844b36c5331cd83
MD5 db7b4945c987e0eb8e153c52db4dfdbd
SHA1 abb261d56dd2ccdb92ee645b5acdfe4f5f7f1d73
SHA512 a5a8ad58230b550a6a804d69f0a889e0a44488cb7dd2c9c0a3c2e010c0eb10e837614645cc145024226165b640667cdda1d17a4c77a9f83f6a4577075fb1cb45
SSDEEP 192:uXLsNZzQCDBBbH0QmiU1T1w4aGBPKnn+FdGN9Q8XFC1SJr1dNeq1Ld0X/dpuI9MW:IsNZzrDfbkr/3dMjCEJr5xx0X1puLFQr
TLSH
T1C1625D366C796C3759A2A541F14B36079FF84137A6C82F94F2DDAB1C01EF69D130B816
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

a25495c2-7960-452d-bb0f-5cd0ab94276b.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\a25495c2-7960-452d-bb0f-5cd0ab94276b.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 a709b46d2f387ea14342a16ca4b0fac372121c7aa1992bcf39669c04af645fe5
MD5 51badc7b88640cc5e9394b00b044afd1
SHA1 0ce069c98d7e982ec885d2fbbaf1bfe38d3be4e0
SHA512 9180352725c16a4a386dbf3ab68e6118844e815f99bcedb388c4f10063239088f6111554dbae82cd6c4e15e066e81ca27ea0ef62aede9e7ed5ade6de2b3e0865
TLSH
T19041D798BAED1144B3B77E5AABF6A4AE447BBD672F16845D00110E4E0A62B40C871B37
MD5 SHA1 SHA512 TLSH

Submit Download