34d475f12fb2d088b32aa0763ece41589e702c787305a3ac5086d029292697cb

Analysis

max time kernel
149s
max time network
156s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260618-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260618-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
20/06/2026, 18:13

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
L2/assets/load.html
Size 1KB
Sample260620-wtppzagt8p
SHA256 34d475f12fb2d088b32aa0763ece41589e702c787305a3ac5086d029292697cb
MD5 17b177ab773d7be1d80dacc775b629a6
SHA1 9c51672fc28bfc7e9ce3c5e148f2642655527a10
SHA512 6da82b0d5401425ac9ca7e74752e3e79af5abca8c07ed3a81225f7a5dd03ae369ff88c19201d1d01ea617c451083a04842fb9eef7cea586316981690ff7f2bac
TLSH
T19321F1496C835204BAAB626947FE75083167A507350DCE08B88DC3E49F85B6A912B5DD
MD5 SHA1 SHA512 TLSH

Score

4^/10

discovery

Malware Config

Signatures

Drops file in Windows directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SystemTemp	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4084	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134264528045014387"	msedge.exe

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2894455325-857903158-4263030270-1000\{DAA89888-C1AB-46D4-8E3A-0FFE5C0DBD68}	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2894455325-857903158-4263030270-1000\{D2459009-8B5C-4A66-B313-3E8AEE46938E}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
688	msedge.exe
688	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
1412	msedge.exe
1412	msedge.exe
1412	msedge.exe
1412	msedge.exe
1412	msedge.exe
1412	msedge.exe
1412	msedge.exe

Suspicious use of FindShellTrayWindow 33 IoCs

pid	Process
1412	msedge.exe
1412	msedge.exe
1412	msedge.exe
1412	msedge.exe
1412	msedge.exe
1412	msedge.exe
1412	msedge.exe
1412	msedge.exe
1412	msedge.exe
1412	msedge.exe
1412	msedge.exe
1412	msedge.exe
1412	msedge.exe
1412	msedge.exe
1412	msedge.exe
1412	msedge.exe
1412	msedge.exe
1412	msedge.exe
1412	msedge.exe
1412	msedge.exe
1412	msedge.exe
1412	msedge.exe
1412	msedge.exe
1412	msedge.exe
1412	msedge.exe
1412	msedge.exe
1412	msedge.exe
1412	msedge.exe
1412	msedge.exe
1412	msedge.exe
1412	msedge.exe
1412	msedge.exe
1412	msedge.exe

Suspicious use of SendNotifyMessage 16 IoCs

pid	Process
1412	msedge.exe
1412	msedge.exe
1412	msedge.exe
1412	msedge.exe
1412	msedge.exe
1412	msedge.exe
1412	msedge.exe
1412	msedge.exe
1412	msedge.exe
1412	msedge.exe
1412	msedge.exe
1412	msedge.exe
1412	msedge.exe
1412	msedge.exe
1412	msedge.exe
1412	msedge.exe

Suspicious use of WriteProcessMemory 39 IoCs

description	pid	Process	procid_target
PID 1412 wrote to memory of 5716	1412	msedge.exe	88
PID 1412 wrote to memory of 3132	1412	msedge.exe	89
PID 1412 wrote to memory of 4084	1412	msedge.exe	91
PID 1412 wrote to memory of 3132	1412	msedge.exe	89
PID 1412 wrote to memory of 3132	1412	msedge.exe	89
PID 1412 wrote to memory of 4620	1412	msedge.exe	92
PID 1412 wrote to memory of 4620	1412	msedge.exe	92
PID 1412 wrote to memory of 616	1412	msedge.exe	93
PID 1412 wrote to memory of 616	1412	msedge.exe	93
PID 1412 wrote to memory of 616	1412	msedge.exe	93
PID 1412 wrote to memory of 1104	1412	msedge.exe	94
PID 1412 wrote to memory of 1104	1412	msedge.exe	94
PID 1412 wrote to memory of 1104	1412	msedge.exe	94
PID 1412 wrote to memory of 3892	1412	msedge.exe	95
PID 1412 wrote to memory of 3892	1412	msedge.exe	95
PID 1412 wrote to memory of 3892	1412	msedge.exe	95
PID 1412 wrote to memory of 3912	1412	msedge.exe	96
PID 1412 wrote to memory of 3912	1412	msedge.exe	96
PID 1412 wrote to memory of 3912	1412	msedge.exe	96
PID 1412 wrote to memory of 5904	1412	msedge.exe	97
PID 1412 wrote to memory of 5904	1412	msedge.exe	97
PID 1412 wrote to memory of 5904	1412	msedge.exe	97
PID 1412 wrote to memory of 3180	1412	msedge.exe	98
PID 1412 wrote to memory of 2584	1412	msedge.exe	101
PID 1412 wrote to memory of 3180	1412	msedge.exe	98
PID 1412 wrote to memory of 3180	1412	msedge.exe	98
PID 1412 wrote to memory of 5920	1412	msedge.exe	102
PID 1412 wrote to memory of 5920	1412	msedge.exe	102
PID 1412 wrote to memory of 2740	1412	msedge.exe	103
PID 1412 wrote to memory of 2740	1412	msedge.exe	103
PID 1412 wrote to memory of 476	1412	msedge.exe	107
PID 1412 wrote to memory of 2472	1412	msedge.exe	108
PID 1412 wrote to memory of 3312	1412	msedge.exe	109
PID 1412 wrote to memory of 2196	1412	msedge.exe	110
PID 1412 wrote to memory of 2764	1412	msedge.exe	111
PID 1412 wrote to memory of 2764	1412	msedge.exe	111
PID 1412 wrote to memory of 2304	1412	msedge.exe	112
PID 1412 wrote to memory of 2304	1412	msedge.exe	112
PID 1412 wrote to memory of 688	1412	msedge.exe	114

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument C:\Users\Admin\AppData\Local\Temp\L2\assets\load.html
1⤵
- Drops file in Windows directory
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1412
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x260,0x264,0x268,0x25c,0x2c0,0x7fff90a2c188,0x7fff90a2c194,0x7fff90a2c1a0
  2⤵
  PID:5716
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1680,i,10776499410705279504,1368010143687585250,262144 --field-trial-handle=2468,i,10009275494059006930,14081337673017449940,262144 --variations-seed-version --mojo-platform-channel-handle=2464 /prefetch:2
  2⤵
  PID:3132
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1848,i,16968396163366310215,1237239839042543641,524288 --field-trial-handle=2468,i,10009275494059006930,14081337673017449940,262144 --variations-seed-version --mojo-platform-channel-handle=3156 /prefetch:11
  2⤵
  - System Time Discovery
  PID:4084
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2452,i,1805802166959468192,11681716192764661101,524288 --field-trial-handle=2468,i,10009275494059006930,14081337673017449940,262144 --variations-seed-version --mojo-platform-channel-handle=3232 /prefetch:13
  2⤵
  PID:4620
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3536,i,8316748429931764717,6617928343002243792,2097152 --field-trial-handle=2468,i,10009275494059006930,14081337673017449940,262144 --variations-seed-version --mojo-platform-channel-handle=3560 /prefetch:1
  2⤵
  PID:616
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3564,i,15214238105312716609,5280171711934667802,2097152 --field-trial-handle=2468,i,10009275494059006930,14081337673017449940,262144 --variations-seed-version --mojo-platform-channel-handle=3584 /prefetch:1
  2⤵
  PID:1104
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4300,i,10861807307966117379,11621815141526011128,2097152 --field-trial-handle=2468,i,10009275494059006930,14081337673017449940,262144 --variations-seed-version --mojo-platform-channel-handle=4480 /prefetch:1
  2⤵
  PID:3892
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4312,i,8414868165882956351,2025786308566168347,2097152 --field-trial-handle=2468,i,10009275494059006930,14081337673017449940,262144 --variations-seed-version --mojo-platform-channel-handle=4500 /prefetch:9
  2⤵
  PID:3912
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=4780,i,234908475276785622,731130433040770838,2097152 --field-trial-handle=2468,i,10009275494059006930,14081337673017449940,262144 --variations-seed-version --mojo-platform-channel-handle=5160 /prefetch:1
  2⤵
  PID:5904
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --always-read-main-dll --metrics-shmem-handle=5444,i,2330844241999684321,16509052610774976399,2097152 --field-trial-handle=2468,i,10009275494059006930,14081337673017449940,262144 --variations-seed-version --mojo-platform-channel-handle=4300 /prefetch:1
  2⤵
  PID:3180
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5956,i,10938211510446243227,10620088576921755519,524288 --field-trial-handle=2468,i,10009275494059006930,14081337673017449940,262144 --variations-seed-version --mojo-platform-channel-handle=5972 /prefetch:14
  2⤵
  PID:2308
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5956,i,10938211510446243227,10620088576921755519,524288 --field-trial-handle=2468,i,10009275494059006930,14081337673017449940,262144 --variations-seed-version --mojo-platform-channel-handle=5972 /prefetch:14
  2⤵
  PID:2584
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5260,i,12742360633034447531,1788894355338111125,524288 --field-trial-handle=2468,i,10009275494059006930,14081337673017449940,262144 --variations-seed-version --mojo-platform-channel-handle=1744 /prefetch:14
  2⤵
  PID:5920
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4816,i,12987388489244637477,13533463455176825170,524288 --field-trial-handle=2468,i,10009275494059006930,14081337673017449940,262144 --variations-seed-version --mojo-platform-channel-handle=3768 /prefetch:14
  2⤵
  PID:2740
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6116,i,8472130412147307041,5299941697829095935,524288 --field-trial-handle=2468,i,10009275494059006930,14081337673017449940,262144 --variations-seed-version --mojo-platform-channel-handle=5988 /prefetch:14
  2⤵
  PID:476
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6044,i,923368222511374448,1984927440671960887,524288 --field-trial-handle=2468,i,10009275494059006930,14081337673017449940,262144 --variations-seed-version --mojo-platform-channel-handle=4564 /prefetch:14
  2⤵
  PID:2472
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6012,i,7853259792384509694,5868724407363330850,524288 --field-trial-handle=2468,i,10009275494059006930,14081337673017449940,262144 --variations-seed-version --mojo-platform-channel-handle=6780 /prefetch:14
  2⤵
  PID:3312
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6564,i,3244219796512926839,1489381643226413367,524288 --field-trial-handle=2468,i,10009275494059006930,14081337673017449940,262144 --variations-seed-version --mojo-platform-channel-handle=3696 /prefetch:14
  2⤵
  - Modifies registry class
  PID:2196
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6560,i,2792029541225153457,12490165338731445695,524288 --field-trial-handle=2468,i,10009275494059006930,14081337673017449940,262144 --variations-seed-version --mojo-platform-channel-handle=6548 /prefetch:12
  2⤵
  PID:2764
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5104,i,3393105059559639671,672439988555818591,524288 --field-trial-handle=2468,i,10009275494059006930,14081337673017449940,262144 --variations-seed-version --mojo-platform-channel-handle=5088 /prefetch:14
  2⤵
  PID:2304
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6456,i,403191220171913902,11237116804315250370,262144 --field-trial-handle=2468,i,10009275494059006930,14081337673017449940,262144 --variations-seed-version --mojo-platform-channel-handle=6316 /prefetch:10
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:688

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:3928

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:6048

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 0f06119439d622a1a5078cf90d2c84d55bc25c179cc319a31bc271a3e62dc8b5
MD5 39897ff436f6a2795449c696417893df
SHA1 b1e15f7b2c6f5ca94bea9d8a160cc9e6864c1d06
SHA512 75fae24fb44003376ccf64d6c3715357ca6f73fb6cca4422a2574a4960dc75c830ef617f5476e7fc21942b321e9fe764ebf9ae64abfc2b05a73fdd7fb96ad95e
TLSH
T1F2D08030FB45B745C78605F2D514A720637A864534C2C60DB2A2D50D98681D0B7E79E7
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 4921dac989a582c68ea2ce6e44eb3bfcd7f8bf3d87dd155763734d09e46d6684
MD5 6fe58dba083868c4939df3729856b544
SHA1 2946fc6a531247a5afe5d20c0abec1329e76da1f
SHA512 435b892e3c3ced9c341bcad7627e98220f381783f6c0d232345dd92e9cb28357bd93211262aa046fe541f6bd0686d5084ac7e92c687fc72829288aa7d9c823de
TLSH
T1B7D08034FB45B745C78605F2D514A720637A864534C2C60DB1A2D50D98681D0B7E79F7
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 4KB
SHA256 7c4493301a8735e00c6114b198dc97f510537597277d1ce17d58abb5358b1c79
MD5 827300414f61d9015756650b9866c581
SHA1 e679047fb9668da74debbc3749545be872b891c2
SHA512 d48f029f5075e593c95c0924601cc78e4c9b5197c7d0c06f9773e4b0d1b0a476561a18fac4006363a2d6142f114c6d7766b8851661ee7f21727125c7fe53d448
SSDEEP 96:Gzx7oQ7rCZNIV38EgM75nNASBiaQiVZ0CJ+zZHMk+SiC5JIIStR34LuQadrXQvPH:Gzx7oQ7rCZNIR8Ez75nNAS8aQiVZ0CJU
TLSH
T115A1A4B891F1E523CFA74B7143E1E4A6F37C1811B8470E87244E583C7E4ABE880E660E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 4KB
SHA256 bbb8aef5fe78c4b01ef52945caa0018329ed6e36a2749d1951188f16d4f9057e
MD5 2da15f21f271e91645f69ab46068bc5d
SHA1 2501b4fab86d2febf221c2585bbd932736e06c33
SHA512 8293be234f4aa21a409092ac39d8fb1304505dbce52ab214e8774c1a00ce4a6b27278eff46412dea441cebb2176f1dc990938b844704029ef0f568bd13e26544
SSDEEP 96:azx7oQ7rCZNIV38EgM75nNASBiaQiVZ0CJ+zZHMk+SiCDoJIIStR34LuQadrXQvg:azx7oQ7rCZNIR8Ez75nNAS8aQiVZ0CJ2
TLSH
T158A194B891F1E523CFA74B7143E1E4A6F37C1811B8471E57244E583C7E4ABE890E664E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index~RFe59579c.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe59579c.TMP
Size 3KB
SHA256 a45be4b34ad417c8e2231285c9c92bc4aeefd7e6f671b6716874e320a1dd1902
MD5 f971798208733c48bbea6ddd4cfc8771
SHA1 0a8449b45672738960495bc15915e6cf99dd2024
SHA512 f0c9ca755beeb45d5d212e1fddf3414bc1ae4806e8bb9c493b26b6d7f9363f76190e2600b6dbe04f79601c46772d6351dd294d96a732b6034c63fdc8006af925
TLSH
T1D0617375D6328A27CFE64AB493F290AB33B81841A9871E573494507C7D9EFCC84EA04C
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 7KB
SHA256 0c4c563657f6a29d134f18dac6082e14d09ac4bd139930f44a3f6df4f471da8f
MD5 2d1861215cf66a48fa79b066e2df3017
SHA1 b56420ca202d81b8751d479849518241aabe1e3a
SHA512 ec132029a98878ceb7bb78f8b09b9d0aac972699b19a09aeb4287424c96f7478b176f6e1c94c1f4c441aea4cc1b1d998a5151cab2c52333db0012769dc0e542e
SSDEEP 192:DahOPOAOPOSO6OuO0O8OD02CqjhnGv1O4O7LOSyO2OPGOUOeOQOoEOxOaYOrOIXD:DahOPOAOPOSO6OuO0O8OD02CqRGNO4Oa
TLSH
T1A0E19CE7C3E9862DDC2156F4AB142D1BCE290924872C3D6AC9D5EF1BB3E14B1D34164E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 1d7d011eb281ac0a28c66da2d70893f3d557a0dcb7146d3ce0ba848b3990fe13
MD5 8f5ddd61b15929e018adcff0abd74e36
SHA1 f1da4770231de12e29cf0f1444d3608723bcde29
SHA512 5c69bfb4e3cca370c07187350fc4566d2715337e212c050e1be64358ed6b42ed3e9c7cfbac17f238f1c7f9fb5ca43c3e4da999775e0813a72ce12948649c336e
SSDEEP 192:sxRmYR8yM/jK1Ml8wFC/fEsOzIylzoA8pqjEl/g6+WNIYPPUyGGFIgDlJ:sxRmY2bC/fEsOzqZ/5ILIJb
TLSH
T1C062DA1665245977CCDBD21DFA95BF53D6F81433F2944E44AAFC8A1C00E6AED221382F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 15KB
SHA256 a5631badb3caaa12d0f0e13ccd1753475960734e9810dcc5e04289ddbe3bacd4
MD5 4bcc33126eae255e2d7ad68dd5073163
SHA1 3c9f0dcefd1a48491e6265fe72fc05e8e4b446dc
SHA512 fceb6eada102ecbf419b86b83167a2da6ef7375e98a1a46096a6a5110a48bb0ffe74743b4556428933e5a2879fa6a8d5df34f2338a7896267b0778f4e1965bb1
SSDEEP 192:sxRmYR8yM/jK1Ml8UQyFC/fEsOBIyDKzoA8pAjEl/g6+WNIYP6AUyGGFIgDHJ:sxRmY2q4C/fEsOBxHH/5IdFIJl
TLSH
T12762C91669245977CCDBD219F691BF63D6F81533F2940E44AAFC8B1C00E6AED621382F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 7e319b0f08bb02d690d6814dba521f7c82ee76adf06df13b2fc239f0fc125f5b
MD5 5951c0ca3c1ba3a511429a123bb243f8
SHA1 ca6e590315d6363b8bb7d52208313d7e50c2ed83
SHA512 49e1b91a940074cde7d87b0c1514318039d69fcc18c7015a4f09656cc1d890e8c415689abb97adf8323ffec648765cec51bb39fa423fbfac357fcb9c499a70f5
SSDEEP 192:sxRmPR8yM/jK1Ml8wFC/fEsyzIylzoA8pqjEl/g6+WNIYPPUyGGFIglJ:sxRmP2bC/fEsyzqZ/5ILIJP
TLSH
T12462D91665245977CCDBD219FA95BF63D6F81433F2940E44AAFC8A1C00E6AED221382F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 27KB
SHA256 59976289e87858b86c89917e34e6dcc146ef979f1d6f4addf1cbcb79ba27b88a
MD5 19843ff52fc0594313595ef23ce11dca
SHA1 1e0b8d1ec3529515a4959384c1f6604907ad61a1
SHA512 2f8d22e97a03da4b747a9a09f3535053c3abd61858b7f8946d91867439f08ca34312b307a2ce86ead01962282591e24e650b9f2655b50f2086f7fe6eee43cf88
SSDEEP 768:LKKg6xWgdVf7k8F1+UoAYDCx9Tuqh0VfUC9xbog/OVJ3nYSrouevdWTmz:LKKg6xWgdVf7ku1jaY3YJuevdWTmz
TLSH
T142C2FC2F240CCB7E4F844EADAD26BE976DD801CB97584D9447EA880C03D77EB521A4DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 11ef110357767c7e790bde0f55b9eb48eb2ec15d84d8729b24597be9b0413fcd
MD5 27427d47d7bef67c12b7b680faf4965c
SHA1 f3228e53d343313f608b7f4ff7b67edb3bd6ee57
SHA512 8090b6d68cde781ac1e63bd3d5e91067013e2b9e615e4a536cbe95eda1539404ad619448254d1215721f28208f035386bc899a5b6bfb85dd39428abca165793b
SSDEEP 24:K9XAbcbIjKHhy1CS+lJyXCdepUFIfK5h61mSMj4h2t0dI/KRhK1uSETHyXHYHO:KMYIjKByU9yBiIfK/6o72I/K3Kgvyj
TLSH
T1C1910466B77632002C7FA50CC1E0D52F668130E27066A82B7FB860E65D6BE415EFC9CD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

d30021d4-79a6-482c-8792-ef6b2cdc9e52.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\d30021d4-79a6-482c-8792-ef6b2cdc9e52.tmp
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 41KB
SHA256 746a20a6fd67ca171ae75a7c308d5fa8914293073325a68b2e377286215fb1fe
MD5 c75f2568daa97bfa2b86156f4c3bd311
SHA1 38eff4bfe03a5344a6fe317607b4e56779d15fb7
SHA512 248a4817e4a8331bf29ef467e96238705611d3602130f33da4b0588b4e9ca21b5d35f2be98578386b36051807bbb826616e316c3dddfafd94ae1b2508b685668
SSDEEP 768:+qjaeqD4MlshiLdMmu369fBcOxflSAUu75riXYUsZUgb9eHcF/+0IT0:+qqcjhIdMB3s3tPiIUsZUgb9sY/j
TLSH
T17413C076DDB8DC578CE296C5B21A72936FB0019385C92A9D5DCC6B0D01E72DE420BC2B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 4a63b50f9f0a62d1ac10dc6e09716f7ab1b8271adc253f88cb64257eb7bad55c
MD5 88d6c1475a0e375a2750ac10e42cadd4
SHA1 cf7c71c2e5ee441700e7b11776cb642436ba80ba
SHA512 93c149d76835794ce0804c5f7d09854276ef73d407e34188284dca8d7b091983ee71075789f125b978f4a9e2f1faa034131ebfb1a23fe90afaf5477d1e9272df
SSDEEP 768:HqjaeqD4MlshiLdMmu3d99BcOxflSAUv75riXYUsZUgb9eHcFMTY:HqqcjhIdMB3X1tGiIUsZUgb9sYD
TLSH
T1D203B075DDB8DC678CF296C4B25776876FB1019386C92E9C6DCC670D02E72DE420B82A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 49KB
SHA256 3996c1497286bdbfcb835b45fdf765556245844084a7b42619d5a89d2b904e16
MD5 0c27b5ca637ab34de9465bd127486ce6
SHA1 64d1c7b8d129ef704e5be228316ffca1c083b1d3
SHA512 d4b2beec44ca830c5c2863bff896c4c0978f22dc9ec05dc11de4f7ff63108b6f15f1d323cbe24c1a92653cd2194b7ba6bd7a4c900d760850ff654441d0a34898
SSDEEP 768:G+F6jaeqD4MlshiLdMm43JwgI9tBcOxflSAU+75riXYUsZUgb9eHcF/+0IT0:GdqcjhIdML3+FtHiIUsZUgb9sY/j
TLSH
T100338DF289E78877CCAD9787A33D2D425EBCC193B48565987BC8590DCD931BFC20A816
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 bb14a80fd86514e751645ee5f486ffa2c0104b9254595509a89b4bed43ad3ef8
MD5 a3ccee7b678fd1999d8331aa6ea95fab
SHA1 b2e1929cbd424a051a5fe14941c976d94a27d757
SHA512 ea43b2779c96faf59ebf1883e4cf7ff5baf13105692e3e0766825754da633fe27b9d32ea11e89539055c0f38a3b20537cd96c6f14b464946540a5d77500259b4
SSDEEP 768:ZkjaeqD4MlshiLdMmJ38UIcOxflJ75riXYUsZUgb9eHU9+ApXTcHT+:ZkqcjhIdMG38BViIUsZUgb9s0+KXP
TLSH
T13003C0799DB49C678CF2D6C4B36B66572FB501A386C52ADC9CCC6B0D02E35CE520782B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

5f8ad89c-ed4e-4d0a-b354-2d01757fcb22.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\5f8ad89c-ed4e-4d0a-b354-2d01757fcb22.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download