b6d7440386f9c2f979bf321fe7f0a06e0dfe44031013c071390e53ed25ff1ae8

Analysis

max time kernel
148s
max time network
148s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
10/09/2026, 12:33

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
otp.html
Size 10KB
Sample260910-prgg9atbmf
SHA256 b6d7440386f9c2f979bf321fe7f0a06e0dfe44031013c071390e53ed25ff1ae8
MD5 2b8d196e3955432c4703bbc46fbf127b
SHA1 150ef908e5618b86d076496b645e37e5ac0785c5
SHA512 0e1b73342f9bbb1356ec8da27c6c22cb3618bb207a842f32222b99bd9f42c738777ff404e661b8b4fb38f59b8f4a73dc68c5e7a73d414e88c6a858b95a51261f
SSDEEP 192:Ph777kJjkRIXyRq34N3rMDtygY+1cV3NvPU60/XUuv5Oi/VL:PN2kHRq34N3AJKR4c6/J
TLSH
T1F322B51632B7057600B3897477DABF12282E87A3D506D529BECC46325FCAE408F97BD5
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
884	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134335172297053646"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-668679576-120646659-2289335452-1000\{517B1A1D-60DE-4187-BD5C-570DAF32C96D}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3992	msedge.exe
3992	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
4172	msedge.exe
4172	msedge.exe
4172	msedge.exe
4172	msedge.exe
4172	msedge.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
4172	msedge.exe
4172	msedge.exe
4172	msedge.exe
4172	msedge.exe
4172	msedge.exe
4172	msedge.exe
4172	msedge.exe
4172	msedge.exe
4172	msedge.exe
4172	msedge.exe
4172	msedge.exe
4172	msedge.exe
4172	msedge.exe
4172	msedge.exe
4172	msedge.exe
4172	msedge.exe
4172	msedge.exe
4172	msedge.exe
4172	msedge.exe
4172	msedge.exe
4172	msedge.exe
4172	msedge.exe
4172	msedge.exe
4172	msedge.exe
4172	msedge.exe
4172	msedge.exe
4172	msedge.exe
4172	msedge.exe
4172	msedge.exe
4172	msedge.exe
4172	msedge.exe
4172	msedge.exe
4172	msedge.exe
4172	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
4172	msedge.exe
4172	msedge.exe
4172	msedge.exe
4172	msedge.exe
4172	msedge.exe
4172	msedge.exe
4172	msedge.exe
4172	msedge.exe
4172	msedge.exe
4172	msedge.exe
4172	msedge.exe
4172	msedge.exe
4172	msedge.exe
4172	msedge.exe
4172	msedge.exe
4172	msedge.exe
4172	msedge.exe
4172	msedge.exe
4172	msedge.exe
4172	msedge.exe
4172	msedge.exe
4172	msedge.exe
4172	msedge.exe
4172	msedge.exe
4172	msedge.exe
4172	msedge.exe
4172	msedge.exe
4172	msedge.exe
4172	msedge.exe
4172	msedge.exe
4172	msedge.exe
4172	msedge.exe

Suspicious use of WriteProcessMemory 32 IoCs

description	pid	Process	procid_target
PID 4172 wrote to memory of 4056	4172	msedge.exe	86
PID 4172 wrote to memory of 1212	4172	msedge.exe	87
PID 4172 wrote to memory of 884	4172	msedge.exe	88
PID 4172 wrote to memory of 1212	4172	msedge.exe	87
PID 4172 wrote to memory of 1212	4172	msedge.exe	87
PID 4172 wrote to memory of 2852	4172	msedge.exe	89
PID 4172 wrote to memory of 2852	4172	msedge.exe	89
PID 4172 wrote to memory of 864	4172	msedge.exe	91
PID 4172 wrote to memory of 2652	4172	msedge.exe	92
PID 4172 wrote to memory of 864	4172	msedge.exe	91
PID 4172 wrote to memory of 864	4172	msedge.exe	91
PID 4172 wrote to memory of 2652	4172	msedge.exe	92
PID 4172 wrote to memory of 2652	4172	msedge.exe	92
PID 4172 wrote to memory of 1116	4172	msedge.exe	93
PID 4172 wrote to memory of 1116	4172	msedge.exe	93
PID 4172 wrote to memory of 1116	4172	msedge.exe	93
PID 4172 wrote to memory of 4256	4172	msedge.exe	94
PID 4172 wrote to memory of 4256	4172	msedge.exe	94
PID 4172 wrote to memory of 4256	4172	msedge.exe	94
PID 4172 wrote to memory of 2236	4172	msedge.exe	98
PID 4172 wrote to memory of 2236	4172	msedge.exe	98
PID 4172 wrote to memory of 1684	4172	msedge.exe	99
PID 4172 wrote to memory of 1684	4172	msedge.exe	99
PID 4172 wrote to memory of 3384	4172	msedge.exe	101
PID 4172 wrote to memory of 4872	4172	msedge.exe	105
PID 4172 wrote to memory of 2152	4172	msedge.exe	106
PID 4172 wrote to memory of 3012	4172	msedge.exe	107
PID 4172 wrote to memory of 2600	4172	msedge.exe	114
PID 4172 wrote to memory of 2600	4172	msedge.exe	114
PID 4172 wrote to memory of 2308	4172	msedge.exe	115
PID 4172 wrote to memory of 2308	4172	msedge.exe	115
PID 4172 wrote to memory of 3992	4172	msedge.exe	117

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument C:\Users\Admin\AppData\Local\Temp\otp.html
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4172
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x260,0x7ff967a6c188,0x7ff967a6c194,0x7ff967a6c1a0
  2⤵
  PID:4056
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1632,i,15647919529500909118,16810226997068379692,262144 --field-trial-handle=2896,i,9104481465104829902,2257793390762012664,262144 --variations-seed-version --mojo-platform-channel-handle=2892 /prefetch:2
  2⤵
  PID:1212
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1976,i,578233279582785138,14346747527184651795,524288 --field-trial-handle=2896,i,9104481465104829902,2257793390762012664,262144 --variations-seed-version --mojo-platform-channel-handle=3108 /prefetch:3
  2⤵
  - System Time Discovery
  PID:884
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2312,i,15548403533471770033,4630027021631124945,524288 --field-trial-handle=2896,i,9104481465104829902,2257793390762012664,262144 --variations-seed-version --mojo-platform-channel-handle=3136 /prefetch:8
  2⤵
  PID:2852
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3436,i,10564320377524647168,7767921105535208600,2097152 --field-trial-handle=2896,i,9104481465104829902,2257793390762012664,262144 --variations-seed-version --mojo-platform-channel-handle=3512 /prefetch:1
  2⤵
  PID:864
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3440,i,9324300839671480219,3664908917055154941,2097152 --field-trial-handle=2896,i,9104481465104829902,2257793390762012664,262144 --variations-seed-version --mojo-platform-channel-handle=3516 /prefetch:1
  2⤵
  PID:2652
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4136,i,3256947318028799876,17525700938762681923,2097152 --field-trial-handle=2896,i,9104481465104829902,2257793390762012664,262144 --variations-seed-version --mojo-platform-channel-handle=4200 /prefetch:1
  2⤵
  PID:1116
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4148,i,9233040748801546398,16613019895935847969,2097152 --field-trial-handle=2896,i,9104481465104829902,2257793390762012664,262144 --variations-seed-version --mojo-platform-channel-handle=4228 /prefetch:2
  2⤵
  PID:4256
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4856,i,12857810358003063335,549799459455211959,524288 --field-trial-handle=2896,i,9104481465104829902,2257793390762012664,262144 --variations-seed-version --mojo-platform-channel-handle=5128 /prefetch:8
  2⤵
  PID:2236
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4516,i,12428951952760866571,10759211027639085527,524288 --field-trial-handle=2896,i,9104481465104829902,2257793390762012664,262144 --variations-seed-version --mojo-platform-channel-handle=5168 /prefetch:8
  2⤵
  PID:1684
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5904,i,8662214226861500884,15080050824849259820,524288 --field-trial-handle=2896,i,9104481465104829902,2257793390762012664,262144 --variations-seed-version --mojo-platform-channel-handle=5916 /prefetch:8
  2⤵
  PID:5104
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5904,i,8662214226861500884,15080050824849259820,524288 --field-trial-handle=2896,i,9104481465104829902,2257793390762012664,262144 --variations-seed-version --mojo-platform-channel-handle=5916 /prefetch:8
  2⤵
  PID:3384
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4952,i,8912543342070340598,4280072278898234720,524288 --field-trial-handle=2896,i,9104481465104829902,2257793390762012664,262144 --variations-seed-version --mojo-platform-channel-handle=4132 /prefetch:8
  2⤵
  PID:4872
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4268,i,14125122568688649765,17290914349817215565,524288 --field-trial-handle=2896,i,9104481465104829902,2257793390762012664,262144 --variations-seed-version --mojo-platform-channel-handle=4504 /prefetch:8
  2⤵
  PID:2152
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4216,i,30270455682784588,14257791037543429712,524288 --field-trial-handle=2896,i,9104481465104829902,2257793390762012664,262144 --variations-seed-version --mojo-platform-channel-handle=4496 /prefetch:8
  2⤵
  PID:3012
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2100,i,10526326155853128558,15687437700485554558,524288 --field-trial-handle=2896,i,9104481465104829902,2257793390762012664,262144 --variations-seed-version --mojo-platform-channel-handle=5388 /prefetch:8
  2⤵
  PID:2600
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5704,i,6466060876343454251,15425415908349561957,524288 --field-trial-handle=2896,i,9104481465104829902,2257793390762012664,262144 --variations-seed-version --mojo-platform-channel-handle=5832 /prefetch:8
  2⤵
  PID:2308
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6156,i,2302249930738083229,736073393179870569,262144 --field-trial-handle=2896,i,9104481465104829902,2257793390762012664,262144 --variations-seed-version --mojo-platform-channel-handle=5128 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3992

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:4572

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

47ab3e61-0cef-4703-a86b-71c33168c25a.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\47ab3e61-0cef-4703-a86b-71c33168c25a.tmp
Size 19KB
SHA256 90cac7fa02ec102908d22693583c42873b0895965519cd59e9104e52043e8173
MD5 496b004f27110db1a11357f33adca049
SHA1 72654548ce0e18a4cbcbc84436611034d3e94386
SHA512 3f8074031b7823f950c0263d111e783c4aa6f661dee109aa7342176e81aeca81dc31ae260c66e422c624b846f3eccf2d86918d1d08e011f7b0b87907299a211f
SSDEEP 384:lqZcIfsNpU3MX4Y9QEa+5OHfaXFjWwxuvzxV+MhdpiBhow:+fGXljaYOH89Ww4184pi/n
TLSH
T12B928E717878AC775DFAA144F88B37078EB880679A8D6F80D6DDAF1D00D7658131EC2A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

blocklist

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\blocklist
Size 105KB
SHA256 a6673ce49b12fdcbb7d76835e1b016504a29767f7212d8e801c405cb7104ab24
MD5 ca6c08209c2d38cddd20d85d8c5dc47a
SHA1 cec1cabd103f18062e7cb4e4d6f0d8b419a6c0bd
SHA512 21049ac949a133b2d3655a743fa48fb77fd023763be431c403808d8b8cc86ade7133ad2fd2407bc2f19378bde77d294fb858d77ccfdd369434389ccbd4e515c6
SSDEEP 1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P7V:fwUQC5VwBIiElEd2K57P7V
TLSH
T17AB3B931457E36BF26E93EE828CF1511B84F3912624895D4ABE1FE2C4845E68633CEF4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CrashpadMetrics-active.pma

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\CrashpadMetrics-active.pma
Size 16KB
SHA256 814d47aad78c212b52568b9c7b58d242899d490d3afebce66181cae50c880df5
MD5 8c7cdfea4284ba987d295d82a9c7ddd6
SHA1 7d1a3a66f2d64a383b230196ba89a263ce7ee957
SHA512 59c8229e834c944265aed4131c79f41f9f940a48651b9fb18800cef5bae36d17c7fd5880120c6fee8ce22a157b65bc63846b65765bc4dc86e15926dcce400d0d
SSDEEP 12:sf9iXhV0xoUZxCe+JKlkQuMRxCb8TXuYJ0IJpPK6BsyW1inPiz:U9iRqxoUZxWMk8xVTeYWI31BtXP
TLSH
T105724C85B34498FFC8835E7189BD27903774F6DF1F02866B6A6A760E2E271C84F44224
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 1c8e6fcbb66aba64fe595f222fc4117e00e82ccdc0eef2100a1b4f7babb04f87
MD5 398d1e7948d46a763209c466fdacd0fb
SHA1 b26f2c32bc106089a59ce779d792beaba59f92bf
SHA512 a0bbf31d803e7333d004f03de9c261732d00cceb5d82dd64b5f0decf8adc8b840891187c72bb21cce83873e6d4dd2fab89d4c7efa320afe2ef3589678dcb1424
TLSH
T1B6D080277A196004F3964175A483D7061319956129575711F310C44CA9775D553C11C2
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 5d2c4e39ddbeb0ac61628bae04f1ac5787600ec893b0e230d1a84d61470771a9
MD5 cd6e704306442404371caebfec7f5b29
SHA1 e4beab8b7820af3633bf7c75a5498a958a95832e
SHA512 de66681a9245e8ece7d7e2ea2080251c395f2aeb8a885ac007eaf16f2ee3a3e36610d2afc17be964a038704371cedfbe4da91143ebed5adac20dbda97768d6e6
TLSH
T13AD080273A196404F7964175A483D7061319956129579712F310C44C99775D553C11C2
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 b60a0e810c872854d4f51ff2745c6fda5dfd9d52de862881da9433730519bc4e
MD5 614614c6ef1e2040c7f08d0c93a313e3
SHA1 f958a0a3e887088a4d5d7c0d4ca5e229ed10f927
SHA512 a0ffe27bea609a78a7ab0b28a3139fabd10ff6b579102a10c1af406cf3c883c4dad41bd12626640735b3e65dccf3388f8b2647c731489cb626997db7f054e9fa
TLSH
T199717D351D714F52EBD402BF64E3F210757A85D8FA131E79C960AB3E2B1C79802ABC56
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5870d6.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe5870d6.TMP
Size 3KB
SHA256 ff8385a4f4a690357626b15c3b90c464b39fdc964e4c3236102359db6cfa1ca9
MD5 8ec279eaccf7af30e306fbb89c5bc930
SHA1 49e557061cf89b664deccf41fe579ca011a2ae85
SHA512 7071f8be91fa13d398453fb9e28ea09a955ef4d32eb94c019958a56b42b6cc06c8a80c584c5efba59b5b2b528eef97b4ae636df155f7402fce7708fb5783682b
TLSH
T147717B350D314F82EBD401BF64E3F210757A85D8FA131E79C9606B3E2B1CB9802ABC56
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 1KB
SHA256 91c2ca40d3f5751e87e250cbec37d69d58da0f974181d7464c30dfb2b0717b76
MD5 c51891745a4e8cbd2b9804a7388a60ef
SHA1 0ef4515a87d4102548c3d865e0e1772bf5cf9201
SHA512 ef5fe335c16acb067c85187b2300c2ce7c6810cfd6c55cebed6761466c3c7a81c2b38a89f6466cf537800e1730ddeec7ea9983a40e24628706fdeb8bd335d8ec
TLSH
T13B118CF3C7E5866E8D1156F05A24AE2BCE2D0506432C7C1589E4FF2B93E3475E10159F
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 8f030154109238137b3d6a609a1a17da5104fc7d6ccc4bcf3ae01a446e09d347
MD5 f338323286f60b5f7cd7f930804534b2
SHA1 7f1c9f1eeaa8616926d10c58a64a7d47813be533
SHA512 1b388bb59aac7ad7ac5c50d071d579891435a5fead8b6d5fcf207e269230a8de1c9b1246c743894d4982f1b81ce586b9b2dcf50012fe087ec73e6fad3f130423
SSDEEP 192:sxZRRryM/jK1Ml8MWD/f+sxJFIdpdSHW6+WNGYCkRr/+kIgrJ:sxZRtuD/f+sxJ2EHbGS//9
TLSH
T1BD42D711AA34A977CCDBD20DBA517F53D6F9547292900E44AAFC8A1C00E7AED221782F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 cd812b1bd9e04a1e371f43292afa107c7cd1a29b43211864a1a5dc72e2baf06a
MD5 0a22a9d87d27164324be251331c50b1a
SHA1 b1660554be34a63464d743e0d22df57aaaba70e0
SHA512 e1936bcb217e03780e084325b9c2a0dffe834332c9da5a6ffd5a788986a6788fced8ed573bbe7b30d0145c3848487e58cb2ac3cb5abcd6d0b848922747d979c9
SSDEEP 192:sxZRRryM/jK1Ml8UQnWD/f+sJLdFIdpHSHW6+WNGYCGyr/+kIg5fJ:sxZRtqWD/f+sJLd2yHbGX//P
TLSH
T11E52D712AA349977CCDBD20DB9417F53D6F9547296900E44AAFCCA1C00E7AED621782F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 30KB
SHA256 e54ee66eff0601bd1bc6f790a9314ff9280db07beb8fabcba8db9f986f9ad522
MD5 66e529f23a2b59505c609d1998449c89
SHA1 53853151d63212df019e3c98e0de3d0ed3913c65
SHA512 6fcb3e7459ed000ee8fc4ebcf3bde01d4f955cd57e2709c05e90cf147b088c78c0db739f8282fa19d73760a090d41f6f6663bb5b651e93560113aba80cf7343d
SSDEEP 768:eD8bqn+WvSCt68F1+UoAYDCx9Tuqh0VfUC9xbog/OVnZLlRTKVhrozY:eD8bqn+WvSCt6u1jaCZLbWVazY
TLSH
T187D20A3B280CCB7E4F845E5DDD26AF962DD801CB6B988D4447FA884C03C76EA512B5DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 a475d37dac6598f60d917ee4e24fdcfd4edd8cc6a20f766b03a541ca6977db3e
MD5 9664f3744f6c7c50ec278140b65eff4a
SHA1 3ae7630a803f77c27873895902adf6b3c4ca850e
SHA512 f0b63ad85d4226fa75fc1d5382d30313a0972f01f6673b73604c240a70c40e82ac689527d3e5f3cacc70e75b98add49758d09c7f840c74a94ded9f4fc80a7d0a
SSDEEP 96:KcOUKnqCKAwKxqmhZsLfZb7xG/2sEnxK84E5xoBJenU:invrhZsLfZb7o/2Ln94E5OBJenU
TLSH
T12B914602713B228138FE290892A3D6768E4272633914A46F7FF944660E7AF515EFDCDD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

4b450dca-2c1b-4335-80b8-8b12ef526aa0.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\4b450dca-2c1b-4335-80b8-8b12ef526aa0.tmp
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 55ecbb098ce9d10e060267d8bac6cc32ef20b7a3fd752d01bcedf55280dcf4b9
MD5 528c0a9cc3eecd361fab9a4734ecfdac
SHA1 42386fe3316bd7d7010e3b2d3e13f8288b19815f
SHA512 96e9b1b784334c992fb8328ea8c0f383bda2afb30ce71c7ed3931fa69ee41dc7bbe7e0374877a566d08ff746393c993bd6c51985964b5d2e61a8992dfd497858
SSDEEP 384:wZcIhsNpUOMX4Y9QEa+5OHfaXFjHwxuvzxV+MhdpiBhow:OhxXljaYOH89Hw4184pi/n
TLSH
T127828E716838ACB76DFAA144F88737174EB880679A8D6F80D6DDAF1C00D7658131EC2A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 21KB
SHA256 ed67ad18bfab34fb0f22d93ba330b2ff7c44a02e71d1aab2450c08b26dc8050f
MD5 783606cdc91716265837cc67114e6363
SHA1 e730d1841a2ae4ff88d56e6f34707a3f78192799
SHA512 fc3bcc602aa91c063d30b439adc751c4ad5485e913f711344945a38292f97a29a7d9557f90e232978a55cfe5b8c63800408b9dd18d567c78946647f73bd49797
SSDEEP 384:YiFiZcIfsNh8TUNTUlIl3MX4Y9QEa+5OHfaXFj6wxuvzxV+MhdpiBhow:jFQfywgKXljaYOH896w4184pi/n
TLSH
T1D6A27D735868DD7BADFA9744F98A33178EF880B7C989AA90E7C99F1C00D7598130EC15
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 2c29ff4f5090d870d6b4426e5b60c77dea422ca4315274f6d1eeb38c7d6e11d3
MD5 04c4d1c8933d8411888071dfb7809009
SHA1 e461d1abd5f0b85642079f3ee92cd995f8f30dc0
SHA512 4c7e3d12c6061d9e652b2053848ddc1dcd57e694a7b64c318bbe63ba4ec8294b8cca097040561a0a6832ec1b04a5bfed303e70e240d7771dccef17fd7e1735ac
SSDEEP 192:vONm6Db6QmiUyI+HBa+j9OmaftmH+RgK6U6:vONm6uAHBa+5OHfallU6
TLSH
T1B502E93569786CB79EB2AE49F48B3B279F94107BDA562F84DAD81F0C00D765C2307836
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 82f9e9d0018ae0a808870f2833e7dc85af4730e8e9bf2ce1c87e9d231f990611
MD5 2e7b76eabea45bd17fc0f8a4850d8f49
SHA1 41940f00a4c6351eff3a524f1cd48e8f1b74ac1a
SHA512 19fa162d786f2e40bc714393299d4f4b7303ea49227f77a1ca131189f8be16d8f752ea900376bdfddbe48307f95645da4f37ad964595cdbff4937837d054126d
SSDEEP 384:fZcIhsNpU3MX4Y9QEa+5OHfaXFjHwxuvzxV+MhdpiBhow:3hGXljaYOH89Hw4184pi/n
TLSH
T11D828D7168386CB76DFAA144F88737079EB8C0679A8D6F80D6DDAF1D00D7658131EC2A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 2c2a0b453301a8e4db51bee5ffb60f1a2a99dbf29654201e2111d6a0ac33a0ce
MD5 7227cbd9327187a1408e874d4eb95954
SHA1 2ada235035ff4521ca78daa33acfd5f11f28bfad
SHA512 2be76bad74fae9244656da8158ab066e85729dc939e91ec39e05d197b28d0c1f4506e4b2feecbf4578a24d44d9cf5065e025815079733a7282f66cdbf4b6a0f1
SSDEEP 192:aONj6DbpQmiUyqC+QBa+j9OmaftmHXFgEONzAqKU6:aONj6vRQBa+5OHfaXFjywU6
TLSH
T1FA122B3678386C775EE2A588F48736179FA84167DA4A7F80D6CC2F0C00DBA5C230F826
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

296d317e-635d-43e7-959f-7abfb3d455f4.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\296d317e-635d-43e7-959f-7abfb3d455f4.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 3794939d3f2503b7e66e94423e51870975c71e6dd8f57b0fe679ca6834491eaf
MD5 986e3b5d05596ee0bf18a33077adfea6
SHA1 10c90ab0943ab0316145d9d2ff7242a842e8145a
SHA512 26abe86534742587440a38fd4afb02f6a575faa7ff979530346a668678930dc95dc617e61c1e8f62277e8cf7c4e96ccc790467296b8cc80ab1bad3627025b078
TLSH
T13241EB59BAF9114CB3B76E599BF7687D487FB8772E0AD45D00110E4F0A62A40C971B33
MD5 SHA1 SHA512 TLSH

Submit Download