ed81d1c208eb798e1806fed4a0eaa950dff37ba7c0a6633a24bf375c27b44268

Analysis

max time kernel
148s
max time network
135s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260618-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260618-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
19/06/2026, 12:19

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
api/index.html
Size 11B
Sample260619-phlevahs9w
SHA256 ed81d1c208eb798e1806fed4a0eaa950dff37ba7c0a6633a24bf375c27b44268
MD5 098905956065a95d4bbfd979b811c911
SHA1 bffc6f34e086836e5f4eb4de85e9514e1dfb3413
SHA512 77f6eb6db830134713be905684e780e6cbb18cf4b4654502920dfe0df588507b9fccebd77bb7f1a1c7182ae85fb26c1f96235f168ebaddcb5cbe6183a6a0ac38
MD5 SHA1 SHA512

Score

4^/10

discovery

Malware Config

Signatures

Drops file in Windows directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SystemTemp	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4208	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134263452079500236"	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2289519114-2956110270-1748446682-1000\{F244C722-C198-4182-9116-7E9F65448A48}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
6072	msedge.exe
6072	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
2860	msedge.exe
2860	msedge.exe
2860	msedge.exe
2860	msedge.exe
2860	msedge.exe

Suspicious use of FindShellTrayWindow 33 IoCs

pid	Process
2860	msedge.exe
2860	msedge.exe
2860	msedge.exe
2860	msedge.exe
2860	msedge.exe
2860	msedge.exe
2860	msedge.exe
2860	msedge.exe
2860	msedge.exe
2860	msedge.exe
2860	msedge.exe
2860	msedge.exe
2860	msedge.exe
2860	msedge.exe
2860	msedge.exe
2860	msedge.exe
2860	msedge.exe
2860	msedge.exe
2860	msedge.exe
2860	msedge.exe
2860	msedge.exe
2860	msedge.exe
2860	msedge.exe
2860	msedge.exe
2860	msedge.exe
2860	msedge.exe
2860	msedge.exe
2860	msedge.exe
2860	msedge.exe
2860	msedge.exe
2860	msedge.exe
2860	msedge.exe
2860	msedge.exe

Suspicious use of SendNotifyMessage 16 IoCs

pid	Process
2860	msedge.exe
2860	msedge.exe
2860	msedge.exe
2860	msedge.exe
2860	msedge.exe
2860	msedge.exe
2860	msedge.exe
2860	msedge.exe
2860	msedge.exe
2860	msedge.exe
2860	msedge.exe
2860	msedge.exe
2860	msedge.exe
2860	msedge.exe
2860	msedge.exe
2860	msedge.exe

Suspicious use of WriteProcessMemory 30 IoCs

description	pid	Process	procid_target
PID 2860 wrote to memory of 4600	2860	msedge.exe	88
PID 2860 wrote to memory of 4544	2860	msedge.exe	89
PID 2860 wrote to memory of 4208	2860	msedge.exe	90
PID 2860 wrote to memory of 3704	2860	msedge.exe	91
PID 2860 wrote to memory of 4544	2860	msedge.exe	89
PID 2860 wrote to memory of 4544	2860	msedge.exe	89
PID 2860 wrote to memory of 3704	2860	msedge.exe	91
PID 2860 wrote to memory of 1928	2860	msedge.exe	92
PID 2860 wrote to memory of 1928	2860	msedge.exe	92
PID 2860 wrote to memory of 2064	2860	msedge.exe	93
PID 2860 wrote to memory of 1928	2860	msedge.exe	92
PID 2860 wrote to memory of 2064	2860	msedge.exe	93
PID 2860 wrote to memory of 2064	2860	msedge.exe	93
PID 2860 wrote to memory of 1272	2860	msedge.exe	95
PID 2860 wrote to memory of 1272	2860	msedge.exe	95
PID 2860 wrote to memory of 1272	2860	msedge.exe	95
PID 2860 wrote to memory of 3800	2860	msedge.exe	96
PID 2860 wrote to memory of 3800	2860	msedge.exe	96
PID 2860 wrote to memory of 3800	2860	msedge.exe	96
PID 2860 wrote to memory of 4676	2860	msedge.exe	98
PID 2860 wrote to memory of 4676	2860	msedge.exe	98
PID 2860 wrote to memory of 1824	2860	msedge.exe	99
PID 2860 wrote to memory of 1824	2860	msedge.exe	99
PID 2860 wrote to memory of 5848	2860	msedge.exe	101
PID 2860 wrote to memory of 4756	2860	msedge.exe	105
PID 2860 wrote to memory of 2776	2860	msedge.exe	106
PID 2860 wrote to memory of 4556	2860	msedge.exe	107
PID 2860 wrote to memory of 2616	2860	msedge.exe	108
PID 2860 wrote to memory of 2616	2860	msedge.exe	108
PID 2860 wrote to memory of 6072	2860	msedge.exe	110

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument C:\Users\Admin\AppData\Local\Temp\api\index.html
1⤵
- Drops file in Windows directory
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2860
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x260,0x264,0x268,0x25c,0x280,0x7ffbfc1cc188,0x7ffbfc1cc194,0x7ffbfc1cc1a0
  2⤵
  PID:4600
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1608,i,14710530000509492184,5713842125826540669,262144 --field-trial-handle=2336,i,9412541031667035191,14076503374683391917,262144 --variations-seed-version --mojo-platform-channel-handle=2344 /prefetch:2
  2⤵
  PID:4544
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1856,i,585978453491154644,3115117656388458414,524288 --field-trial-handle=2336,i,9412541031667035191,14076503374683391917,262144 --variations-seed-version --mojo-platform-channel-handle=3032 /prefetch:11
  2⤵
  - System Time Discovery
  PID:4208
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2456,i,2880349948142908981,17480749305683179075,524288 --field-trial-handle=2336,i,9412541031667035191,14076503374683391917,262144 --variations-seed-version --mojo-platform-channel-handle=3164 /prefetch:13
  2⤵
  PID:3704
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3616,i,4570378834701394970,11415698148887628734,2097152 --field-trial-handle=2336,i,9412541031667035191,14076503374683391917,262144 --variations-seed-version --mojo-platform-channel-handle=3640 /prefetch:1
  2⤵
  PID:1928
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3624,i,240726920940423991,8460387594699415008,2097152 --field-trial-handle=2336,i,9412541031667035191,14076503374683391917,262144 --variations-seed-version --mojo-platform-channel-handle=3648 /prefetch:1
  2⤵
  PID:2064
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4352,i,11396472000514246820,11112811499099116322,2097152 --field-trial-handle=2336,i,9412541031667035191,14076503374683391917,262144 --variations-seed-version --mojo-platform-channel-handle=4512 /prefetch:1
  2⤵
  PID:1272
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4364,i,12872046041720986498,17083300665906341102,2097152 --field-trial-handle=2336,i,9412541031667035191,14076503374683391917,262144 --variations-seed-version --mojo-platform-channel-handle=4660 /prefetch:9
  2⤵
  PID:3800
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5384,i,4339948517164075332,18260675908870488022,524288 --field-trial-handle=2336,i,9412541031667035191,14076503374683391917,262144 --variations-seed-version --mojo-platform-channel-handle=5444 /prefetch:14
  2⤵
  PID:4676
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5380,i,11535616225605001917,11592231971348517415,524288 --field-trial-handle=2336,i,9412541031667035191,14076503374683391917,262144 --variations-seed-version --mojo-platform-channel-handle=5412 /prefetch:14
  2⤵
  PID:1824
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6076,i,17561781276259364787,10729383798649202975,524288 --field-trial-handle=2336,i,9412541031667035191,14076503374683391917,262144 --variations-seed-version --mojo-platform-channel-handle=6100 /prefetch:14
  2⤵
  PID:1260
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6076,i,17561781276259364787,10729383798649202975,524288 --field-trial-handle=2336,i,9412541031667035191,14076503374683391917,262144 --variations-seed-version --mojo-platform-channel-handle=6100 /prefetch:14
  2⤵
  PID:5848
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6076,i,11362329251959927055,4928998979347320745,524288 --field-trial-handle=2336,i,9412541031667035191,14076503374683391917,262144 --variations-seed-version --mojo-platform-channel-handle=3652 /prefetch:14
  2⤵
  PID:4756
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6192,i,14008325041041592432,1739631350456247386,524288 --field-trial-handle=2336,i,9412541031667035191,14076503374683391917,262144 --variations-seed-version --mojo-platform-channel-handle=5252 /prefetch:14
  2⤵
  PID:2776
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6100,i,3078860633583069610,9942411592720936691,524288 --field-trial-handle=2336,i,9412541031667035191,14076503374683391917,262144 --variations-seed-version --mojo-platform-channel-handle=5248 /prefetch:14
  2⤵
  PID:4556
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5268,i,6023078256748468678,9258418788172950843,524288 --field-trial-handle=2336,i,9412541031667035191,14076503374683391917,262144 --variations-seed-version --mojo-platform-channel-handle=600 /prefetch:14
  2⤵
  PID:2616
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=2088,i,8363068597260196283,10945362546321105649,262144 --field-trial-handle=2336,i,9412541031667035191,14076503374683391917,262144 --variations-seed-version --mojo-platform-channel-handle=6232 /prefetch:10
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:6072

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:5596

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:5804

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 2b471d5790d1e8ac94438a5662d0ed854761db5162e9ed715d3f950974387da2
MD5 f3139b9e55fe18feb36cb00db002d273
SHA1 755162342b8e0f46c67a7ca7edf74a3293cdaeb7
SHA512 d229aade54d55576064d540cb4f4250cd3d32106eb04bcac5449501aba91bfbfe3857ca0457eab714fad16945c3e3a00e1b408afe8edd04cdf8574cf34450a48
TLSH
T17CD0C02437457610C40D05704410CE02C133C803B0C3DA003032C50CC5158C0FBCD0EB
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 b842906cea16d7b3aa3205573cacb7d4d1d2364d11253f46244aaa1a7745db30
MD5 aff0d41e14c14a0f33ef71eb300b3517
SHA1 1b323ae2f9d64108caaa43e8fc26a953c57942d4
SHA512 7d91f5d419c8dab3b5c13b763160d5c782dae9d50314591afda7d0f4db293ab075d234d6ab8602002e921be583a3c7b2c7977545c7522af94ab7cfae1e8bd620
TLSH
T1FAD0C02037457510C40D05704410CE02C133C80370C3DA003032C50CC5158C0FBCC0D7
MD5 SHA1 SHA512 TLSH

Submit Download

68cbfa1c-f2ce-4935-a620-95cac5eb3725.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\68cbfa1c-f2ce-4935-a620-95cac5eb3725.tmp
Size 27KB
SHA256 53cac52e2bc37180f8383ceaa241dacf70c6c27b391f87e914f6ffffdc6e1e60
MD5 77937d9accfd47cd6b0e2c57a4597418
SHA1 a9d5acea853e5fac3d2d61623654485377bb8897
SHA512 da6227453a8230810ae6fe1fb95b42189f05b88c09d70074f7752e2b84b26679adf9fc7a17a7dfc68565aa815cdfe65fb11be6f926925508d383434d60049fab
SSDEEP 768:v1D847WgeEftq8F1+UoAYDCx9Tuqh0VfUC9xbog/OVpDZhtrol2ZFg:v1D847WgeEftqu1ja0NhGx
TLSH
T1F2C20B3B640CCB7E4F844AADAC29AED66DD801CB97988D5447EE880C03C67FB511A5DF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 432B
SHA256 9fee6fbb5593a2f0d1a98ce58cae97caa8eb494df3192e01c2d906139a3a6f2b
MD5 a4be8a735285c4263586b804c4de7908
SHA1 ed3fc23d223c57906a15cbb37e3d1a84b6501324
SHA512 6f77bcd23cad98f64a811e147272c48675f0de0fda6088900b0b61f36c77e43bd765037341a944d1822dee7870ca6c16ee924233aa54a9ea33826dd10e47d0eb
TLSH
T110E026AC7A17C063E358D6B824F121893B306409F10F1C3486641837B0B43B01057B4A
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe592cb3.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe592cb3.TMP
Size 432B
SHA256 da3a553be8bc4535368f44b4c0896a2a97db9c0bb24fa55c791fd2f9003bded8
MD5 c8cd4eeacdb8a79f05c7627a8b3a4433
SHA1 2121c7d23e631aecae74cd02c9b4231d04afdf81
SHA512 97e42eb0517887fbf0f6d9ced34c343e9be00e0cba51340abc4ab79f02b43c5d793ee6ce344bb6744e7a745a32fe89f077eb1cf485531a058f4860b5b879606f
TLSH
T1C2E026AC7A07C063E358D17464F0218D3B306449F10E1C3186640837B0743B01053B5A
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 ce17f450af8f8dd8b08993dc8b7e1490565bb4930fa88b6f81f68c3714caab1d
MD5 1b87b6a932740b243ad1aae1bedf7dbe
SHA1 56a40c96c950726ce6c2f1c98341a4af4c659d3d
SHA512 6d2e44f4d54aaed2e5e5cb9fa680d5c2e7a991efe313f4e52faa17e9f28990f0553c0a51457ddcc40cad9254986a26b41e15fe408da6a7b149bacbc55ea41f07
TLSH
T1154199F3C3E8866EC91146F4BA187E2FCE1D0914432C3D5AC9E4EF1B93E2861E14195E
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 9f135d52bea3d88aa42fa8c436190a664c53405f429cc21afbe62fd8175eacbe
MD5 a7e2af6b4b3152519031dd9c329d6a36
SHA1 c49196556b43081979fe1edb99065645bc4d22a0
SHA512 ac07c982e05f2f8a80d9086753038aad3648d6c9e487344c3652deb5c7ddc39f26750551ea8015af74e2555b9d8c8d323e7061bd0a5cb2b015d1c2aa125c5e58
SSDEEP 192:sxRhRbyM/jK1Ml8wFf/fmsBBaDVB9p6KzoA8p4J/g6+WNIYJOf+GvIgIJ:sxRhrbf/fmsBBaBB9p6H8/5IZhs
TLSH
T12A52D916AA345977CCDBD309FA55BF53D6F81573B2901E44AAFC8A1C00E6ADD221382F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 83929b7f85d8696d7767c99e5c5f52f0885f93b4e18cb64c51a4aa69802ef5a7
MD5 90f83cd85b650c95987b23c1212040cf
SHA1 99fec327813a587303e1b0d120ff75de349745d3
SHA512 37d68f80a593b0856f4115a020bcc2c3f2a7c510f6a24a70fd4ce1f7b672d15559cf697269b777eab01315b1d9a6d5d66350eceb42c9b21a4bc2bf5ca665e48d
SSDEEP 192:sxRORbyM/jK1Ml8UQAFf/fmsayaDVB9p6KzoA8peJ/g6+WNIYJaf+GvIgDwJ:sxROrq2f/fmsayaBB9p6HW/5ILhw
TLSH
T13A62C916AA345A77CCDBD209FA51BF53D6F81573B2941E44AAFC8B0C00E6ADD211782F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 5c66c80e0d3cbe5980dbbe3cdcd2f9696c82f7bb118ce175d4177a9e1858c3d6
MD5 a2a1be6e9d9c69676a87a1e2035a69d9
SHA1 ad3e5631ad4e5c572a83f74cb692121696f63375
SHA512 03e78bd6c420c0d0f137cc64e09ca99ef11150f5bcfb0846a3985912ad2ae3b9b0c7d79d6b398a185ea25395ba6b1c44b6a0cc9bf7ca65c23f950342368130fe
SSDEEP 192:sxRORbyM/jK1Ml8wFf/fmsaBaDVB9p6KzoA8p4J/g6+WNIYJOf+GvIgDKJ:sxROrbf/fmsaBaBB9p6H8/5IZhC
TLSH
T1C952DA16AA345977CCDBD309FA55BF53D6F81573B2901E44A9FC8A1C00E6ADD221382F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 3890baae0554a41df1401666336e977ec01e20315cb9c0deda64cc43813042cb
MD5 0509c1f1c64dd9985c581d12a4809f1f
SHA1 7cbaead1b2e6fd3ede7484f22086f32303091054
SHA512 0e2e6ce90124cf2f374af38132ced99441d25676fa7cf750abd2aec3153d762db326136df7f6d86585c9b9d6cf775ab290e67b9fa51ce19a20024c5416f5d4a0
SSDEEP 96:KgrWKg0SYP+T/BNJkZNAPznkKrBzpkXf/gBEJw7vJrLhKPq8oHhKwIoJhMhZiHrZ:gtD6Jw7vJrL8PqbH9IoJShZiHriRs7ge
TLSH
T1F99144C6B47A22447CFD751880B8856EA5917477720E68AB37BC20E74B66E001EFCDD9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

OperationConfig

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig~RFe59c7ab.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig~RFe59c7ab.TMP
Size 3KB
SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
MD5 904e6e94a1d46374c8630cfd86cc729f
SHA1 e1d9c3f7813878acc6510d48d95b2bf48b2e1a0d
SHA512 081e2a26252860ff8d8f7a9d0378ae56f0cc50574d13d2a121afdf74284963747ef874a4d73b1df7774cd8570972f4f513eefe0a0325fd088556d5b1ba946712
TLSH
T1DB815C4FCC0CBE77ABAB6A719A35D6B2F79131EA94518A977F8C444EE3050ED0242E50
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 331b2785a31a6ec10182a043bc4f76c0cd0173d0cb2d324e8ca91b1b30de98bf
MD5 4fad701bcdac3dd4e1cd38cccbe7aafe
SHA1 e04800a61c561caaeabd4a26c24f10cb182d72c2
SHA512 4c16b9dccc9a97517b7c5e0b749caf9dcf9145bc5456cef045f0177dfac6567489761afc33ccd31e33616337b5d933a8c3dcf76cdb50622d431e4bee2b2c7ba6
SSDEEP 768:IjaeqD4MlshiLdMmp3Uj5G5VCgZSVCKPFECrBhpjcNqJ9TV:IqcjhIdMy3R8gs0KPF1HRcEJr
TLSH
T18D03BF76E8E46D738CB6D285B107B687AEB402DBD2C92E8C99DD660D05CB3DE1207C17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 37KB
SHA256 6a873a790efdc4a155dd44cacf88781695dbdcf24b23e0e73439e3d7a762df7b
MD5 ed234ff7e4f6aa93bd1f6c22d8c6c68d
SHA1 099f39b9a6f2cb15565490f8ed78589deeecd17e
SHA512 53b11186f4154a3944977487f3f3a385441599eb82cf6317fd2be4e8a683b7d396634ccfc4a42c52014d1c38c786fe2eeac52c4b5d47af4a4d34fbddb66a5a60
SSDEEP 768:TF1j+973kwgGj5G7VCgZSVCKPFECrBhpjcNq/+05vu:C973i8gs0KPF1HRcE/1vu
TLSH
T17F03AF7398949E778DB6C794F10B724AAEF402E7D5C52A889ADD6E0C05CB3EC1347C16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 35KB
SHA256 e98d17c8c3235eabaa4b96def9db277b816d30ef26e657c02cbdf47f84a8137b
MD5 3acdf8b2584a5fa0ffe6e03dcf224030
SHA1 acd0da43534fd50f6d5e4045fc33713eaffff211
SHA512 fda537d51b77b39ce04b672205b44f22e40c62a1f936f9257a7fbd6d62c4b9ccd43ba1b4499b30188814c10c50e1ab2730a83c35f4ba6389332fad3e55f02aac
SSDEEP 768:fj+9f3Pj5G5VCgZSVCKPFECrBhpjcNq/+05vu:S9f3I8gs0KPF1HRcE/1vu
TLSH
T134F2BF72A8A4AE638CE6C294B107B24A6EF40797E1C51E8899ED7F0D05CF7AD1347C17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 e8e0093fe6d45931b9c6d61db74e52c1d5c993b9dc17ef679fcfe84338e51fea
MD5 d722f63a0cbcc293979f17b847b4a2e7
SHA1 b68c95d2a6b52ec61faedb8eeac6d4264b96aaf9
SHA512 20ec10c85ad603627027a5861a37eeda2819e5ca5f15628556da9d1ae776b534f0e422ed1df7e710510270e95339adc6472b3c171290fd070762c2f3de34d923
SSDEEP 768:bjaeqD4MlshiLdMmu3Va5GAVCgZSVCKPFECrBhpjcxk+ApX32TB:bqcjhIdMB3I8gs0KPF1HRcy+KXk
TLSH
T18F03BF79A8A45EB38C77D245B207B1466EB84297D7C92F8CD8ED6A0D41D73CD134382B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\metadata.json
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download