hxxps://click[.]em-latam[.]esss[.]com/?qs=ABB7InYiOjEsImQiOjQ5ODV9AA0AAAAAAQuxH--waC7zHOvytSuwNra5wNXNe8Ikinj4NneDxSgKho5cZmbSEHDi3pimo1uRi8bOIm5WgCCNN_sAfC7dEzA4H6AWA2zP5egdKHQd

Analysis

user interaction
yes
max time kernel
149s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
31/08/2026, 18:06

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://click.em-latam.esss.com/?qs=ABB7InYiOjEsImQiOjQ5ODV9AA0AAAAAAQuxH--waC7zHOvytSuwNra5wNXNe8Ikinj4NneDxSgKho5cZmbSEHDi3pimo1uRi8bOIm5WgCCNN_sAfC7dEzA4H6AWA2zP5egdKHQd
Sample260831-wp4ckazycs

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4588	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134326732168778800"	msedge.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1074038928-2032447174-945360078-1000\{DB2F11C7-01FA-4689-8E43-DC336CF660E5}	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4048	msedge.exe
4048	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
3884	msedge.exe
3884	msedge.exe
3884	msedge.exe
3884	msedge.exe
3884	msedge.exe
3884	msedge.exe
3884	msedge.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
3884	msedge.exe
3884	msedge.exe
3884	msedge.exe
3884	msedge.exe
3884	msedge.exe
3884	msedge.exe
3884	msedge.exe
3884	msedge.exe
3884	msedge.exe
3884	msedge.exe
3884	msedge.exe
3884	msedge.exe
3884	msedge.exe
3884	msedge.exe
3884	msedge.exe
3884	msedge.exe
3884	msedge.exe
3884	msedge.exe
3884	msedge.exe
3884	msedge.exe
3884	msedge.exe
3884	msedge.exe
3884	msedge.exe
3884	msedge.exe
3884	msedge.exe
3884	msedge.exe
3884	msedge.exe
3884	msedge.exe
3884	msedge.exe
3884	msedge.exe
3884	msedge.exe
3884	msedge.exe
3884	msedge.exe
3884	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
3884	msedge.exe
3884	msedge.exe
3884	msedge.exe
3884	msedge.exe
3884	msedge.exe
3884	msedge.exe
3884	msedge.exe
3884	msedge.exe
3884	msedge.exe
3884	msedge.exe
3884	msedge.exe
3884	msedge.exe
3884	msedge.exe
3884	msedge.exe
3884	msedge.exe
3884	msedge.exe
3884	msedge.exe
3884	msedge.exe
3884	msedge.exe
3884	msedge.exe
3884	msedge.exe
3884	msedge.exe
3884	msedge.exe
3884	msedge.exe
3884	msedge.exe
3884	msedge.exe
3884	msedge.exe
3884	msedge.exe
3884	msedge.exe
3884	msedge.exe
3884	msedge.exe
3884	msedge.exe

Suspicious use of WriteProcessMemory 36 IoCs

description	pid	Process	procid_target
PID 3884 wrote to memory of 2956	3884	msedge.exe	85
PID 3884 wrote to memory of 4588	3884	msedge.exe	87
PID 3884 wrote to memory of 2612	3884	msedge.exe	88
PID 3884 wrote to memory of 4840	3884	msedge.exe	89
PID 3884 wrote to memory of 2612	3884	msedge.exe	88
PID 3884 wrote to memory of 4840	3884	msedge.exe	89
PID 3884 wrote to memory of 4840	3884	msedge.exe	89
PID 3884 wrote to memory of 1080	3884	msedge.exe	90
PID 3884 wrote to memory of 1080	3884	msedge.exe	90
PID 3884 wrote to memory of 1100	3884	msedge.exe	91
PID 3884 wrote to memory of 1080	3884	msedge.exe	90
PID 3884 wrote to memory of 1100	3884	msedge.exe	91
PID 3884 wrote to memory of 1100	3884	msedge.exe	91
PID 3884 wrote to memory of 3320	3884	msedge.exe	93
PID 3884 wrote to memory of 3320	3884	msedge.exe	93
PID 3884 wrote to memory of 2196	3884	msedge.exe	94
PID 3884 wrote to memory of 3320	3884	msedge.exe	93
PID 3884 wrote to memory of 2196	3884	msedge.exe	94
PID 3884 wrote to memory of 2196	3884	msedge.exe	94
PID 3884 wrote to memory of 4660	3884	msedge.exe	98
PID 3884 wrote to memory of 4660	3884	msedge.exe	98
PID 3884 wrote to memory of 4660	3884	msedge.exe	98
PID 3884 wrote to memory of 3316	3884	msedge.exe	99
PID 3884 wrote to memory of 3316	3884	msedge.exe	99
PID 3884 wrote to memory of 5028	3884	msedge.exe	100
PID 3884 wrote to memory of 5028	3884	msedge.exe	100
PID 3884 wrote to memory of 828	3884	msedge.exe	101
PID 3884 wrote to memory of 828	3884	msedge.exe	101
PID 3884 wrote to memory of 828	3884	msedge.exe	101
PID 3884 wrote to memory of 4740	3884	msedge.exe	103
PID 3884 wrote to memory of 3336	3884	msedge.exe	113
PID 3884 wrote to memory of 2632	3884	msedge.exe	114
PID 3884 wrote to memory of 2460	3884	msedge.exe	115
PID 3884 wrote to memory of 3492	3884	msedge.exe	121
PID 3884 wrote to memory of 3492	3884	msedge.exe	121
PID 3884 wrote to memory of 4048	3884	msedge.exe	128

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://click.em-latam.esss.com/?qs=ABB7InYiOjEsImQiOjQ5ODV9AA0AAAAAAQuxH--waC7zHOvytSuwNra5wNXNe8Ikinj4NneDxSgKho5cZmbSEHDi3pimo1uRi8bOIm5WgCCNN_sAfC7dEzA4H6AWA2zP5egdKHQd
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3884
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x2b8,0x7ff8c83bc188,0x7ff8c83bc194,0x7ff8c83bc1a0
  2⤵
  PID:2956
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1824,i,11628069720482181767,10315973215958907686,524288 --field-trial-handle=2276,i,9172066604091742692,13031027719295351472,262144 --variations-seed-version --mojo-platform-channel-handle=2816 /prefetch:3
  2⤵
  - System Time Discovery
  PID:4588
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2380,i,342158577769929075,4987823304415876376,524288 --field-trial-handle=2276,i,9172066604091742692,13031027719295351472,262144 --variations-seed-version --mojo-platform-channel-handle=3028 /prefetch:8
  2⤵
  PID:2612
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1672,i,13413956960880661951,4946625091645426149,262144 --field-trial-handle=2276,i,9172066604091742692,13031027719295351472,262144 --variations-seed-version --mojo-platform-channel-handle=2260 /prefetch:2
  2⤵
  PID:4840
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3436,i,11502083748617487783,13459836794514841750,2097152 --field-trial-handle=2276,i,9172066604091742692,13031027719295351472,262144 --variations-seed-version --mojo-platform-channel-handle=3488 /prefetch:1
  2⤵
  PID:1080
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3440,i,18415879290752349836,11256004992066543387,2097152 --field-trial-handle=2276,i,9172066604091742692,13031027719295351472,262144 --variations-seed-version --mojo-platform-channel-handle=3492 /prefetch:1
  2⤵
  PID:1100
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4148,i,14077054978787529178,14120832333415539948,2097152 --field-trial-handle=2276,i,9172066604091742692,13031027719295351472,262144 --variations-seed-version --mojo-platform-channel-handle=4160 /prefetch:1
  2⤵
  PID:3320
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4176,i,9020712058293496678,9308459068887133639,2097152 --field-trial-handle=2276,i,9172066604091742692,13031027719295351472,262144 --variations-seed-version --mojo-platform-channel-handle=4180 /prefetch:2
  2⤵
  PID:2196
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=3628,i,1030274406416457133,17922807511504077477,2097152 --field-trial-handle=2276,i,9172066604091742692,13031027719295351472,262144 --variations-seed-version --mojo-platform-channel-handle=3612 /prefetch:1
  2⤵
  PID:4660
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5228,i,18382770015667213459,17663816794170120569,524288 --field-trial-handle=2276,i,9172066604091742692,13031027719295351472,262144 --variations-seed-version --mojo-platform-channel-handle=5316 /prefetch:8
  2⤵
  PID:3316
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5260,i,14688541938323603545,13105277639005323391,524288 --field-trial-handle=2276,i,9172066604091742692,13031027719295351472,262144 --variations-seed-version --mojo-platform-channel-handle=5256 /prefetch:8
  2⤵
  PID:5028
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --always-read-main-dll --metrics-shmem-handle=5712,i,339498458353124776,18379574152891185520,2097152 --field-trial-handle=2276,i,9172066604091742692,13031027719295351472,262144 --variations-seed-version --mojo-platform-channel-handle=5732 /prefetch:1
  2⤵
  PID:828
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6464,i,8730760429189754155,358020261918875108,524288 --field-trial-handle=2276,i,9172066604091742692,13031027719295351472,262144 --variations-seed-version --mojo-platform-channel-handle=6480 /prefetch:8
  2⤵
  PID:4160
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6464,i,8730760429189754155,358020261918875108,524288 --field-trial-handle=2276,i,9172066604091742692,13031027719295351472,262144 --variations-seed-version --mojo-platform-channel-handle=6480 /prefetch:8
  2⤵
  PID:4740
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4224,i,10775595275599868596,1523948212753650010,524288 --field-trial-handle=2276,i,9172066604091742692,13031027719295351472,262144 --variations-seed-version --mojo-platform-channel-handle=4476 /prefetch:8
  2⤵
  PID:3336
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6560,i,3106289255021789955,3266496999208484801,524288 --field-trial-handle=2276,i,9172066604091742692,13031027719295351472,262144 --variations-seed-version --mojo-platform-channel-handle=4496 /prefetch:8
  2⤵
  PID:2632
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4232,i,17257306884119491406,3645336032761594757,524288 --field-trial-handle=2276,i,9172066604091742692,13031027719295351472,262144 --variations-seed-version --mojo-platform-channel-handle=4480 /prefetch:8
  2⤵
  PID:2460
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5300,i,5083424908731548820,2515003331141044829,524288 --field-trial-handle=2276,i,9172066604091742692,13031027719295351472,262144 --variations-seed-version --mojo-platform-channel-handle=5520 /prefetch:8
  2⤵
  PID:3492
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6568,i,7734518044023723681,6962471727315945380,262144 --field-trial-handle=2276,i,9172066604091742692,13031027719295351472,262144 --variations-seed-version --mojo-platform-channel-handle=3648 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4048

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:2156

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

blocklist

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\blocklist
Size 105KB
SHA256 dc3cbdc636712cd0ad246adb60e10a6c82511eff5067261c392024fae841e7a9
MD5 c1825e771385238aa2866582788cf8ff
SHA1 cdd34f1c740914ce98dfac6172ecd00fb2da9783
SHA512 33f14925d45545eb4c68af5b5b273b9724142601b0f5098ecd00afa7d2c73115a7bbfbde0f2118a5645868d8b32a69bd2a748d5d5a3d469656956f8af0313fdf
SSDEEP 1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P7C:fwUQC5VwBIiElEd2K57P7C
TLSH
T14FB3B931457E36BF26E93EE828CF1511B84F3912664895D4ABE1FE2C4845E68633CEF4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 8c5b1a407270ca9ae8bec8f20cc56244f3bde6f042890a4cabcdf4df3d21fdad
MD5 16f782e6f4d4592598936b2f29b6b339
SHA1 5c8c22b7f56af2b2e0d9978418f077cc8fd13c41
SHA512 28b2f7186b910539fa22408b47131fb16874b4c2192a721a69393efd7812da561ea9977b8af678cd3a9e37c23f186f876d7086a20afe28b16659db70955cf16f
TLSH
T15DD09232B7C9E241E14232BAA81447826E2A4A68259AC2176478844CEC6984AA79D28B
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

f_000083

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000083
Size 343KB
SHA256 07afd00bc6b13e35f702104aebea04e61d7f90b8447559279895e5f72cabd471
MD5 f39ab38ee79b1eb354356116d49017c4
SHA1 b97e8c1d90d46d372791af31561daa69e132d7c0
SHA512 01217bff1fb5b28e6d1e5e02473ea3154c97f36f87b8973da56e8ca84b636e0de2c318cedffaedf0c76ee90d3eb2e26e6689d5a973538b6f0f91bda10c7a5253
SSDEEP 6144:nQbTrYgHjNyXvc/D0GyVq9bk72B3QM/lUs7Jv2zjWriqGfkMzZh1RqXOzKY:nmTsgHHLlq72iM/mPzjWrykMzZhXqXSV
TLSH
T1177423D43C829CDEB5717D27911A93A6C213B4052D40E39377DB808A7E8B5E852FF86B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 4KB
SHA256 b195887408156070244f84d0a36d71d8b57fdd005a8e471927353f42d6be0ac4
MD5 52276b8a30ec55b2a9e77cb376ce74fb
SHA1 1014af58098a24fce4a9aac4246aef0669c71e08
SHA512 aae66be071f81dec16bbcd235fb6c29fefb519ab21bfd16845db6c9bf1f63f5aa7237367405d7fc3392b38f26abf190eaaccfb60a1eb17d388401b74850c4ccf
SSDEEP 48:ZR+ZFLt7XaNfhmCFB7/faWn0mbTdhxTmYlam3qqJoQy9vw3v2e13jOkC:ZgZRtr0f8C3lDBnmCamTJop1w3+ezdC
TLSH
T1B191FC1BCD9E0C51E731AAB2E0F52D21B7BB5A1CB9532E2128045D7E350FBE87C60186
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 10KB
SHA256 bac9ee3c9dc57cd89e9f30cd16d306a297d7ee64fff09a144206848fb535e105
MD5 68a170ba092fd436f3523914bdaef88d
SHA1 d49110999345f326cf6cedca80883133adc92207
SHA512 1cd760ad71d2a9fd2ae7f5dfceca5c9d4308d43519391fd77f6389c877139d3e3ca184b880956c83e20a5587a7136486eca87c569f3a6a9e80a5cba1638d8e12
SSDEEP 192:DHM/sz5EDm7gJFy5e2eavxT/REY+bR8j4mUvKPqsuGRjVYaau18VkEIfIs7kjHNo:DHM/sz5EDm7sFy5e2eavxT/REY+bR8jX
TLSH
T1113249F7D3E8C26ED83192F0AA143E3BDD290955423C7D0AC5E4EE5A93E2471E191A4F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 bde4aed7eb29605177ef9037744d1ae53657c8bf2c58dbd3b6d6690ca428c647
MD5 ad993708e9c294d096ee038e2440b2eb
SHA1 19b61e77e725837ea2d1bde20bbb97bcd8018393
SHA512 9ffef6f379799caf692a69743b1374a8cb8e18f1d331e7225a91c495d1005236c2291d46f50163c631dc14dd6be3fa9cfae69776c3dde8e0c7b8b9088b509228
SSDEEP 192:sxZMRR8yM/jK1Ml8UQ4jkG/fxs5fOzIdpA2HW6+WNGW1/Y4R/3ZIg5OJ:sxZ26q4IG/fxs5fOs7HbB/Nw
TLSH
T18B52F812AA349977CCDBD20DFA85BF53E6F5457292900E44A9FCCA1C00E6BED221781F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 35fdeed9fa68a003468a6dc8b68f1be0af263002a6eac20f698691fdee74c154
MD5 e83b529cbe41ec44f378c6a05323ae22
SHA1 df6cd6b0c915c1f7ec7d00ee75be43e7538aa650
SHA512 01482529f433354c4046122e121c7e3c5d472f6578d081197ca9564835cb3a71d93165314ef53ca6713531bc8db27b8068baf65b84af01dd533fd6fbddf34b5c
SSDEEP 192:sxZMRR8yM/jK1Ml8MkG/fxs5fOzIdpG2HW6+WNGW1/Y4zo9ZIg5OJ:sxZ26MG/fxs5fOsRHbB/mw
TLSH
T1AA52E812AA349977CCDBD20DFA45BF53E6F5457292900E44AAFC8A1C04E6BED221781F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 84a730ea5085465e588d302c7fcfcf87ff276e66a20e87c344766dcf623dc581
MD5 aa4108e4ac1245f87d23b751a549174b
SHA1 f63291e9b90ca7b2f72718b5942164b799b718a3
SHA512 e1fbc9d2b7ad1eaccb4eca47449c03d4772aaf5040852e22db935c83a13577edc52bdf2e5f9406729436934ab7f8308ebe3f8978cfe43f64a370a05122b9df28
SSDEEP 192:sxZMRR8yM/jK1Ml8MkG/fxsBfXzIdpG2HW6+WNGW1/Y4SW9ZIgrJ:sxZ2yMG/fxsBfXsRHbB/z9
TLSH
T16E52F8126A34A977CCDBC20DFA55BF53D6F5456292900E44A9FC8A1C04E6BED2217C1F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 30KB
SHA256 844e581a7dc45d11696a9e0752a2d818a338373bf69cf836f8db5485abefdf3c
MD5 e6a5839d9e47123069ae2940d0ec7596
SHA1 5d10d88cf319016419bd1ff7cd787ce4c274119f
SHA512 8bda81de0c86cef829bce87981d15c20d3b25915629cd1fce23721bff2e35d2dda1ee3221c70e8f8637f0c9c9efe92c8e094998d09716b463b710951ae13b48c
SSDEEP 768:GE8iJPNWvx76r8F1+UoAYDCx9Tuqh0VfUC9xbog/OVsALl6opdVro9kBUny:GE8iJPNWvx76ru1jahALocduUUy
TLSH
T19FD20B3B680CCB7E4F844E9CEC266F966DD801CB5B984D5447FA880C03C76EE512699B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 5KB
SHA256 8ea455bd8ec5fd83b0a27f0aedc1a7d8c273ace3a298c5e4871eba1a2b0004af
MD5 0aaac8fceadb56e50452253f8867ef2e
SHA1 00114db923895b1a1df61c6797a28ea238c540e9
SHA512 871ea278f94cac69e06ea33287e1621e3f67e250152b5e1a7f37c359911ead04bf2bf0718171e414017e68d21e878ad1baabd95651e030c51ee742ba025c0ae2
SSDEEP 96:KkOkKHK6TEPIkumW28mJ9Wk2K+TWi2yMERSFnaK8QymF+Kmof:S3TEPIkumWlmJkk0TWi5MERSYBNC
TLSH
T1D9B14501B2FB42453C3F791D92518AABA7827463311EA42B3BF900B50F66E610EFD8DD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

cf218a6e-1aa4-4956-bbde-8e8fefa5e008.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\cf218a6e-1aa4-4956-bbde-8e8fefa5e008.tmp
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig~RFe599021.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig~RFe599021.TMP
Size 3KB
SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
MD5 904e6e94a1d46374c8630cfd86cc729f
SHA1 e1d9c3f7813878acc6510d48d95b2bf48b2e1a0d
SHA512 081e2a26252860ff8d8f7a9d0378ae56f0cc50574d13d2a121afdf74284963747ef874a4d73b1df7774cd8570972f4f513eefe0a0325fd088556d5b1ba946712
TLSH
T1DB815C4FCC0CBE77ABAB6A719A35D6B2F79131EA94518A977F8C444EE3050ED0242E50
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 26KB
SHA256 db171d4ff5afd3f469b30d98a039a2c039b81c13399ff8eb4cbb5c14d4771fa9
MD5 2723f89854a504f67b554f50044191e9
SHA1 22add4b725831409ad0cdf585671849a1baa120a
SHA512 67904785918f0934533965b3804800db095c8a9c28dfc80309835bc093dfed2bc5750d8f4283d4b6748fdf72f4dc0bb7e4b68dc4808bfb6836df62c0bcb2dd41
SSDEEP 384:miFiZcI4sNM8TUNTUlIlby2KvdkhOp3VeZ80X1puLDeoz:NFQ4ZwgY3KOpW8syLDeo
TLSH
T1AFC209F248E7853AD9AE9747F77D2D038EBCC167B5846A90B388551CCC9A17FC306815
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 90d5971db33c748682ec44103b4fb5798bf493d80e49efa6819f094b56abaa44
MD5 777ed45f7b2a03749da284fce664f4b6
SHA1 f9c493b78b854a2a1d26a795fd8c0fe4c4530d20
SHA512 c792b36d03605f369a302e305bf0530c41255e82edf22c927632fa54ff509d74c3a23ad86b180b776c159fc6a6aee8543d82aea9bbfa01ac14f48db08de2cebb
SSDEEP 384:yZcIhsNEby2KfdkhOp3Ve080X1puLDeoz:AhG3KOpp8syLDeo
TLSH
T111826B725CB85C7B59F3E549F58632178FB8C127E6C86F84E5DCAB1C05DE698030B82A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 e5ac8c8263785f46c529ea61a72d3b99b5831e5635e4fb2d2497c36a9ba0e62b
MD5 a673c3adc99b269fe36e37e9b2946f3f
SHA1 88c64ebed927189efbce16daaa77026051b8750b
SHA512 7497b68d01f896e5ffcbaf74523bfb766e2b3e3947bac945b9ebaf84c4ccb319bb3afaea634888310d83fc81a983d2802d6227f8d46db5ed0a53c331fc853c1d
SSDEEP 96:ZqONkIQsjpfmUTmDK5ih/cIPURHl8h4otop5/5DDBhPwivh50xy0SFYKEAxnO0Bd:gONY6kDfQmiUyRdZ903yO4+TQiDo1U6
TLSH
T1FD02F8356C782CBB8EA3AE49F44737275FA5112FEAC52FC4D9E82A1C40C734C2346826
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 fba051b13b1eb948dde34856ea67aa018346070681bc214e88182e64306e0235
MD5 c87445099e0247aa5972f089f5646a51
SHA1 e62065859138493d3315283b843d09202882501d
SHA512 3d9279adfba0b1b38f5995944c904a1c2291d3152fdb4fa6903b8870e71744484c72ed23ca54eda61c1adaa869c9f8356d81cb8d601912ca701d1e7aa82e5a6c
SSDEEP 192:SONt6kjQmiUyod/903yO4+R5pbr9eXcR7q3U6:SONt64J/9hOp3Ve48U6
TLSH
T184122A3268786C7B5EE39949F48732139EA5812BEBC96FD5D5DC3A1C05DF35C130A822
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 8fae8bdd0aa8cebf9802afd6c02543b2cc5ddfd8832e261a18f043d0bd9f2efc
MD5 f2b6d35d970fac595f01efd61d64d1b5
SHA1 8e366cc11e6bf6ce4dafd3bc09979f7a4070be05
SHA512 116603b91fa5797acd5a7302af33a011e035cedf9ee00b16e3180526fee7eb62a4f2262d6c437251fc528c5d283f84d87328a97cd855e497a8b81a34d9dbfa30
SSDEEP 384:vZcIhsNEmy2KfdkhOp3Ve080X1puLDeoz:nhD3KOpp8syLDeo
TLSH
T164827C725CB8587B19F3E149F58A32078FB8C127E6C86FC4E5DCA71C05DE298030B82A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\metadata.json
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 27eba0401dabb867ff6806c2c2f91244309d409a9f227595838f65774433f0c9
MD5 accf8c08b2cc9fc3681f8e0dfe303701
SHA1 9ce86288c72892d0cd61c1a594470b41bb05a475
SHA512 2cbce3255ce816c4cf3b2bb19935ea6a2a9e73642e0093d56bf7fae84d3039be45daa0236d1a7ecd6bc62ae94ef516c7b7117abcee9f6fbfda433b62dcbe8430
TLSH
T17C412A5CA6EA0148B3B76F4AAFF6A86D483F79662F0A905D00110D4F0A63B40CDB1737
MD5 SHA1 SHA512 TLSH

Submit Download