d05c3cb523e0a849fdc9bf257e7dfe85e7d4b3fa1b4dee68994ae68befae6350

Analysis

max time kernel
148s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
10/09/2026, 12:33

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
HomeCredit-IDN/2.html
Size 11KB
Sample260910-prfkysw1ds
SHA256 d05c3cb523e0a849fdc9bf257e7dfe85e7d4b3fa1b4dee68994ae68befae6350
MD5 2d534aec01ec5babf129cab3e836f976
SHA1 6027baac9bc9228fdd1fc000124fcb87acceef23
SHA512 e598f96a25e1912c38cc7976b3f2a177b7f510987d44bb54e55dea1fd6e858a0a639954060c549f4829c0e8cb4bdc5c831cba5c1c8a579beb78bed7dca39b2cc
SSDEEP 192:pVVDXLvWMcjMuxzLhmaNjH9FciNJZ2OFjMP8uhBscExDr:pVBmVrBTFjMZQ
TLSH
T11C32A81716B31072645395BC7BE7CB45AAA58103C209CA483FDCA3889FCE9A59D637EC
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
1076	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134335172267781003"	msedge.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1788976790-1541110888-1636651838-1000\{C8B3EE16-5D4F-41D9-8F48-0537FDC44ED4}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1564	msedge.exe
1564	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
4452	msedge.exe
4452	msedge.exe
4452	msedge.exe
4452	msedge.exe
4452	msedge.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
4452	msedge.exe
4452	msedge.exe
4452	msedge.exe
4452	msedge.exe
4452	msedge.exe
4452	msedge.exe
4452	msedge.exe
4452	msedge.exe
4452	msedge.exe
4452	msedge.exe
4452	msedge.exe
4452	msedge.exe
4452	msedge.exe
4452	msedge.exe
4452	msedge.exe
4452	msedge.exe
4452	msedge.exe
4452	msedge.exe
4452	msedge.exe
4452	msedge.exe
4452	msedge.exe
4452	msedge.exe
4452	msedge.exe
4452	msedge.exe
4452	msedge.exe
4452	msedge.exe
4452	msedge.exe
4452	msedge.exe
4452	msedge.exe
4452	msedge.exe
4452	msedge.exe
4452	msedge.exe
4452	msedge.exe
4452	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
4452	msedge.exe
4452	msedge.exe
4452	msedge.exe
4452	msedge.exe
4452	msedge.exe
4452	msedge.exe
4452	msedge.exe
4452	msedge.exe
4452	msedge.exe
4452	msedge.exe
4452	msedge.exe
4452	msedge.exe
4452	msedge.exe
4452	msedge.exe
4452	msedge.exe
4452	msedge.exe
4452	msedge.exe
4452	msedge.exe
4452	msedge.exe
4452	msedge.exe
4452	msedge.exe
4452	msedge.exe
4452	msedge.exe
4452	msedge.exe
4452	msedge.exe
4452	msedge.exe
4452	msedge.exe
4452	msedge.exe
4452	msedge.exe
4452	msedge.exe
4452	msedge.exe
4452	msedge.exe

Suspicious use of WriteProcessMemory 34 IoCs

description	pid	Process	procid_target
PID 4452 wrote to memory of 4460	4452	msedge.exe	87
PID 4452 wrote to memory of 3980	4452	msedge.exe	88
PID 4452 wrote to memory of 1076	4452	msedge.exe	89
PID 4452 wrote to memory of 3980	4452	msedge.exe	88
PID 4452 wrote to memory of 3980	4452	msedge.exe	88
PID 4452 wrote to memory of 4108	4452	msedge.exe	90
PID 4452 wrote to memory of 4108	4452	msedge.exe	90
PID 4452 wrote to memory of 5004	4452	msedge.exe	92
PID 4452 wrote to memory of 740	4452	msedge.exe	91
PID 4452 wrote to memory of 5004	4452	msedge.exe	92
PID 4452 wrote to memory of 5004	4452	msedge.exe	92
PID 4452 wrote to memory of 740	4452	msedge.exe	91
PID 4452 wrote to memory of 740	4452	msedge.exe	91
PID 4452 wrote to memory of 1176	4452	msedge.exe	94
PID 4452 wrote to memory of 1176	4452	msedge.exe	94
PID 4452 wrote to memory of 1176	4452	msedge.exe	94
PID 4452 wrote to memory of 936	4452	msedge.exe	95
PID 4452 wrote to memory of 936	4452	msedge.exe	95
PID 4452 wrote to memory of 936	4452	msedge.exe	95
PID 4452 wrote to memory of 3916	4452	msedge.exe	98
PID 4452 wrote to memory of 3916	4452	msedge.exe	98
PID 4452 wrote to memory of 3428	4452	msedge.exe	99
PID 4452 wrote to memory of 3428	4452	msedge.exe	99
PID 4452 wrote to memory of 752	4452	msedge.exe	101
PID 4452 wrote to memory of 3340	4452	msedge.exe	105
PID 4452 wrote to memory of 4356	4452	msedge.exe	106
PID 4452 wrote to memory of 4916	4452	msedge.exe	107
PID 4452 wrote to memory of 4244	4452	msedge.exe	108
PID 4452 wrote to memory of 4244	4452	msedge.exe	108
PID 4452 wrote to memory of 3972	4452	msedge.exe	109
PID 4452 wrote to memory of 3972	4452	msedge.exe	109
PID 4452 wrote to memory of 1868	4452	msedge.exe	117
PID 4452 wrote to memory of 1868	4452	msedge.exe	117
PID 4452 wrote to memory of 1564	4452	msedge.exe	118

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument C:\Users\Admin\AppData\Local\Temp\HomeCredit-IDN\2.html
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4452
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x2b4,0x7ff81ad6c188,0x7ff81ad6c194,0x7ff81ad6c1a0
  2⤵
  PID:4460
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1820,i,13807263345341967351,17850994238654139767,262144 --field-trial-handle=2336,i,9283093765014574705,2174978375898285613,262144 --variations-seed-version --mojo-platform-channel-handle=2332 /prefetch:2
  2⤵
  PID:3980
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1984,i,2047280390422116031,5900174349923464434,524288 --field-trial-handle=2336,i,9283093765014574705,2174978375898285613,262144 --variations-seed-version --mojo-platform-channel-handle=3068 /prefetch:3
  2⤵
  - System Time Discovery
  PID:1076
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2352,i,18237331130441087187,17092678417613663191,524288 --field-trial-handle=2336,i,9283093765014574705,2174978375898285613,262144 --variations-seed-version --mojo-platform-channel-handle=3092 /prefetch:8
  2⤵
  PID:4108
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3468,i,11742725551758780962,2453087528848259683,2097152 --field-trial-handle=2336,i,9283093765014574705,2174978375898285613,262144 --variations-seed-version --mojo-platform-channel-handle=3512 /prefetch:1
  2⤵
  PID:740
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3476,i,5744379114642747560,13507614347424814691,2097152 --field-trial-handle=2336,i,9283093765014574705,2174978375898285613,262144 --variations-seed-version --mojo-platform-channel-handle=3492 /prefetch:1
  2⤵
  PID:5004
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4172,i,12485866332141438320,17474570068812989785,2097152 --field-trial-handle=2336,i,9283093765014574705,2174978375898285613,262144 --variations-seed-version --mojo-platform-channel-handle=4236 /prefetch:1
  2⤵
  PID:1176
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4180,i,13138581190546462760,2835672383285636017,2097152 --field-trial-handle=2336,i,9283093765014574705,2174978375898285613,262144 --variations-seed-version --mojo-platform-channel-handle=4288 /prefetch:2
  2⤵
  PID:936
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5136,i,6730865053028549942,12516128770474661971,524288 --field-trial-handle=2336,i,9283093765014574705,2174978375898285613,262144 --variations-seed-version --mojo-platform-channel-handle=5132 /prefetch:8
  2⤵
  PID:3916
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5140,i,12328542855936764453,12398112614111645578,524288 --field-trial-handle=2336,i,9283093765014574705,2174978375898285613,262144 --variations-seed-version --mojo-platform-channel-handle=5168 /prefetch:8
  2⤵
  PID:3428
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5880,i,14835737924436533994,6468670865382093362,524288 --field-trial-handle=2336,i,9283093765014574705,2174978375898285613,262144 --variations-seed-version --mojo-platform-channel-handle=5916 /prefetch:8
  2⤵
  PID:4736
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5880,i,14835737924436533994,6468670865382093362,524288 --field-trial-handle=2336,i,9283093765014574705,2174978375898285613,262144 --variations-seed-version --mojo-platform-channel-handle=5916 /prefetch:8
  2⤵
  PID:752
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4180,i,12813797018447290716,13038957044088488970,524288 --field-trial-handle=2336,i,9283093765014574705,2174978375898285613,262144 --variations-seed-version --mojo-platform-channel-handle=4252 /prefetch:8
  2⤵
  PID:3340
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4176,i,7360017451256826352,1324929675722668139,524288 --field-trial-handle=2336,i,9283093765014574705,2174978375898285613,262144 --variations-seed-version --mojo-platform-channel-handle=4328 /prefetch:8
  2⤵
  PID:4356
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3556,i,15412212703116188384,4052970776201509562,524288 --field-trial-handle=2336,i,9283093765014574705,2174978375898285613,262144 --variations-seed-version --mojo-platform-channel-handle=6288 /prefetch:8
  2⤵
  PID:4916
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4176,i,2457483977687077410,1171555412706112713,524288 --field-trial-handle=2336,i,9283093765014574705,2174978375898285613,262144 --variations-seed-version --mojo-platform-channel-handle=4584 /prefetch:8
  2⤵
  PID:4244
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5792,i,14897117666529211038,6209754540204348973,524288 --field-trial-handle=2336,i,9283093765014574705,2174978375898285613,262144 --variations-seed-version --mojo-platform-channel-handle=5224 /prefetch:8
  2⤵
  PID:3972
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5244,i,8005041003321388600,6551702089102146909,524288 --field-trial-handle=2336,i,9283093765014574705,2174978375898285613,262144 --variations-seed-version --mojo-platform-channel-handle=6208 /prefetch:8
  2⤵
  PID:1868
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6440,i,7895523076699818125,16038661123927251626,262144 --field-trial-handle=2336,i,9283093765014574705,2174978375898285613,262144 --variations-seed-version --mojo-platform-channel-handle=5216 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1564

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:2244

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

53d228a1-a94a-4243-8522-8413457570df.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\53d228a1-a94a-4243-8522-8413457570df.tmp
Size 15KB
SHA256 7860f961d486152d34ef1826c524631651ed612a859f6fd6a59f19f0141d9b95
MD5 6c5021d214abdcbcd4138f168f8fbe05
SHA1 0d03229363cb725bc717335214d6d957922adbc1
SHA512 1d2f123946875b48845cc7e6b774152e7dbf84bb7d48aa0ac9f8ff484b41079f74b6a4d1394f53e7ebaed6cdf1584fdc6723c466e509b7c2a965ff4ab7f614af
SSDEEP 192:u7m+xasuheOwQxMGsNKUU/5Q3Y83GM7oQWQmiU1vMRn4MTZS+FdLK7Fd3E/8z12j:tZcIhsNKUU/5l8377Ry2R4GdwdUEkU+
TLSH
T180625C71AC746D3BADE7B185F48636135FF4803BDAC46B50E6EEAB1D00DA6AC0317816
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 92b83a0e542b7bb3ed324c35b5f2a40c47a6351981065b804e4d9d80ddd6d7ee
MD5 9ea20a12d0c030ae7f84014f382662b7
SHA1 7912569189cf07c1ce092a268e67e9f391b7c8c7
SHA512 39ca414f13163c8479fe7650ae0dd1607b267fe3f319c09aec7bd5f68448e9ac604351069bf6b166b3f897d3afb5d7f35e609b9fc72b9debbcb05bad8fad7d81
TLSH
T132D02B20FF04E002D1072172540047100E0848902093C140E030441CDCEC804D395307
MD5 SHA1 SHA512 TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 6KB
SHA256 a19407516c34a4e85b141987f63c79671f4b982933894e86f61565f25e5fada7
MD5 e0cc2a91277f9d58340838a6d665b0e0
SHA1 a075d1f1d3c01aadb786e98ad99f6aeeb0966543
SHA512 bc980bdb7bf014251f9ccf9c041a3258de585b3a7b625ed9c6971242cae642056e7bd749958a580b8009606e80ba1643ef853d3315104d1a64f3336b720d779a
SSDEEP 192:oj066XTggggggggggggggddddddddddddddMYLO:oj066XTggggggggggggggddddddddddc
TLSH
T1EBE17E1383F9D79ACF06118A89A0675C41703B09EBDCDA0C179D8DEA304F59EB9B9A91
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 00b97076a177e79ff204661554e5c276c02d7def2122a1a884d059dd0256c6bc
MD5 5d3f41684468de0b51962bec8a8f647a
SHA1 7240123229db32c1785bdefcf3285819f44bdd5d
SHA512 52f9afede6167d462be03e69d0eac709cb81d3c7749dc8a050df1201ddf32e020acced8ca21f9939ad657be0aeb59e2c07a5e82b7d06d725a628bfb3d517cf31
TLSH
T12D712AB4012E26ACE7965F31C0DE42913771AAFAFD3B5F97DC9260FED9157604829038
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 949B
SHA256 a4959dee7dd17c1b9245197bbe2d83457d8ef07a5843842385c12b5d747115e9
MD5 b2436e7f3464e635fa4b4f939c4e5f6d
SHA1 eaf2e8d771c0298f34e99a5229055e82441b1eaf
SHA512 48c4859c6fcf04e5502da0be0e13e845cfac4f985c66a32329b149411942f783ebe2d67256618b983b636aa92012033c3448c60ff67f998bdab1aab0b9671ac6
TLSH
T1EA11BAB3C3D585AECE4156F05A24AE2BCE2D0A02421C3C19C9D4EF6B93E3475E10299F
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 7c943cf7a092b86e6ae5f2d514b3b10777a6fab27bfb69fb5acfb326edd182d7
MD5 c723a64680bee43280e30a9b99f987f0
SHA1 0491613524c4c4d684800f071016e8d08399c840
SHA512 06eef848fcbe1a063d7d42a250e75be71403dc3602e2fc9a7d004ec0d7c5642cf117f59e321b668186b424b9ebd58804a106cf52c200ed99d0344c101ad4c3e5
SSDEEP 192:sxZ1RyyM/jK1Ml8MWv/fKsY5V5IdpdOHW6+WNGYvraV8+FIgrJ:sxZ18uv/fKsY2IHbGt8+9
TLSH
T142420911AA34697BCCDBD20DFA45BF53D6F95472A2900D44AAFCCA1C04E7AED221781F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 1a9bc2231f85096ebffd9fe69718497b616cedbfb6cf4dd7b53ab4add7abb05d
MD5 6a09ea9a848603881ba6e17519ee6831
SHA1 5a1c819138365fb449f4a8a9a32b1e80034f0fbc
SHA512 54a5a3b03a0ecfa11694353c624592ce0e7638e883d7a8a01ef139c72ba351cfe454ec1ef5005f5559d7d80bf081d6f51240898c431d6eee724bb95cbe06fa6b
SSDEEP 192:sxZ1RyyM/jK1Ml8UQLWv/fKs85V5IdpHOHW6+WNGYvMl58+FIg5+J:sxZ18qqv/fKs82uHbGH8+k
TLSH
T12B52F712AA345977CCDBD20DFA41BF93D6F9547296900E44AAFCCA1C00E7AED621781F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 30KB
SHA256 1aeb96c5eba621bf163e27e5613c5b20be8fc0b76cbe29920759f72b40593a7e
MD5 51445ad7210e05ca4928806f4bb04e8d
SHA1 388a6c3912d1e078f3c2bd05f2e58f801ffcc68a
SHA512 a2c395a8041c60dfb24c9991ae27599372029d4c5b21a7cc42f977b74967c23ade6e31859414f87ddc65302e390fe695d4ced09654fbc55e7b44282086068608
SSDEEP 768:e8seJ3xWvhfyn8F1+UoAYDCx9Tuqh0VfUC9xbog/OVYcLly0ppJroPH:e8seJ3xWvhfynu1jaVcL88pif
TLSH
T1B5D20B2B680CCB7E4F844E5CEC266F966EE801CB57984D5487FA884C02C77EB51275DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 5KB
SHA256 66c39af09811e816854146bb72ebe9f9f99b3a25f36870f6d0fe6043ebbb1e6f
MD5 41cfac07a8a187b4d3cace3daa163581
SHA1 c9855d7c2b6eb322e5d7decc9ed1e7f947303d04
SHA512 ba944a67e864dfb45c7d192bb1b1b7f5315cfd25cdcb601e9ee1849f5595661ce919d8a7929dc70a28b62fb59c11259f118526586b4d733988c3123f4b7be8c4
SSDEEP 96:KYH+KggmC8gKZWiKK0KrCq2JyKScLr0HrR5:49TT33pL
TLSH
T1A9C11342343F0202387E2958B2A39E3A8E4271637414A5FFBBB900A15E67E151EFDCDD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

41da26e1-3068-4193-93d6-0ba9893cdec7.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\41da26e1-3068-4193-93d6-0ba9893cdec7.tmp
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 15KB
SHA256 a97747806edff07e1a8b289779dec5a2cf26c3922f35d441ded1c85a5889e934
MD5 828eb9cca03592bce5ca3ba69a0750a1
SHA1 008b602970d89aab2d52669a896422a437934a9d
SHA512 8709c3330f2288265a103be409d278fe4d3fd79cc8e73b460a2453813f1b13812b65cbe00415c709556fa7024ab9549f4f3a693de66907c15d780da7f17d194c
SSDEEP 192:ulm+xasuheOwQxMGsNKUr/5Q3Y83GM7oQWQmiU1vMRn4MTZS+FdLK7Fd3E/8z12j:zZcIhsNKUr/5l8377Ry2R4GdwdUEkU+
TLSH
T1C5625C71AC746D37ADE7B185F48636135FF48037DAC46B50E6EEAB1D00DA6AC0317816
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 6ccb654a525ee665525d2bd7184d7e14dacc2006865f214cea11e9d142cb69c2
MD5 ef6463f837e330f4a0a60c4cf5b7c88f
SHA1 9d287f049c1f14b1c743246b3fde4d3d666a024b
SHA512 10a57732cd846243d330aa0022dcb17beecd3c76d074023274ddfe4353911cc0155207d37061d78a986b4eebd7720124c68dae5b889e2f72b76f530cc9f3fc55
SSDEEP 384:kiFiZcI2sNv8TUNTUlIlU/5l8377Ry2R4GdwdUckU+:/FQ2iwga/L8L7RtUUckU+
TLSH
T162824C739CA4993BADF7AA85F54A32138EF48177DAC5AA90E7DD9B1D00971EC0307C12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 2e8d22de3da2c9ad4445a903fc50ed0295e7f9a0844069dbf0ed48488e34a954
MD5 4c2d0f341e7e76ceda15c5f013305f5a
SHA1 44674471ced862130e0765eb3bc99d4354fef94e
SHA512 492d512ffa820895a7ba87903a413324b98582153cb34e7a157030acc615091c776ab3bf69575c5a818e0f8d36b584ddd82d66f5e429f99c44cc9753498902e1
SSDEEP 192:lONnZ6vMtPQmiUy92ThTZS+FdLF847eSU/u:lONnZ6UtR/TFdJlU/u
TLSH
T111020835AC786C6BEAB3AD49F48A37175FE4507BAAD01B50EAE86F1C00D765C1303827
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 9KB
SHA256 65986f9305907c357de1b60ac441182397526e50678bcf43f0317d021f8b628e
MD5 c45889491a9fc7d85010056d55affcc4
SHA1 8e1dd5168978269384130276c0018a57ed297c0f
SHA512 55245495c900b9d793a0609b285f68f22668db3b00610c3f1c6301d5fb91352ef9f43c624cbea0f91e17f393f6192c75aceeb575284f13b2336754db4ba07be4
SSDEEP 192:XON46vM2PQmiUyw2uhTZS+FdLK7Fd3E380I2qAU/u:XON46U2RIuFdwdUokU/u
TLSH
T1F1122B71AC746C2BAEA3B585F08A36035EB4817BDEC56B50EADD6F1C01DB65C1307C16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

03a62b7f-9426-45ba-bc7d-2c24e3dd45a9.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\03a62b7f-9426-45ba-bc7d-2c24e3dd45a9.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 bf573809dfd8b50ff23a7439e80c8cd9c90909e980ef2c13fdae6ebb7d6882df
MD5 2f304a3987214685060d0dcc7a3a0e01
SHA1 67760f3496ad5887cd43fa2306f6d52cbffffd33
SHA512 b14545369aabf0df20f2d0eb0d6195c8f49f61e17a87531d405d4f9840e38b6da8fe443dbc6a6142fe70d05ea79cc0c5d464b490b5aa4e4baa7cb03a5d26582f
TLSH
T1A241D648BAEA1108B3B76E5AABF6A56D487AB9772E07D45D50100E4E0A73F40CD61B33
MD5 SHA1 SHA512 TLSH

Submit Download