a027815051346f9353327a5a29669b1e98808b7fb413b3125848afc87407e6b7

Analysis

max time kernel
148s
max time network
152s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260618-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260618-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
23/06/2026, 08:52

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
adgf49.html
Size 3KB
Sample260623-ks235aby2x
SHA256 a027815051346f9353327a5a29669b1e98808b7fb413b3125848afc87407e6b7
MD5 e3ddcc93ad2d91d7a47719ebeab86d76
SHA1 38009cdd3098fd57013de753722dba046b4d2023
SHA512 eec8c6a2c31bc50607e105da70841e1eb7549bc07e4b08a7def4cec9d2d3b5851a69f68aa1a8114d8bb331fa06001d3dd0fc6033bcfe6c372867794596d2b075
TLSH
T18F6184A766F30035B92391B62BF7274A3580E0078409ED147EDDA34C8FC1AF1E8A368C
MD5 SHA1 SHA512 TLSH

Score

4^/10

discovery

Malware Config

Signatures

Drops file in Windows directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SystemTemp	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
1156	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134266783733296723"	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-4118910392-3846778420-3545080915-1000\{9F9ED760-73E1-41EE-8CBB-079AF3E09865}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
5096	msedge.exe
5096	msedge.exe

Suspicious behavior: LoadsDriver 4 IoCs

pid	Process
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
3616	msedge.exe
3616	msedge.exe
3616	msedge.exe
3616	msedge.exe
3616	msedge.exe
3616	msedge.exe
3616	msedge.exe

Suspicious use of FindShellTrayWindow 33 IoCs

pid	Process
3616	msedge.exe
3616	msedge.exe
3616	msedge.exe
3616	msedge.exe
3616	msedge.exe
3616	msedge.exe
3616	msedge.exe
3616	msedge.exe
3616	msedge.exe
3616	msedge.exe
3616	msedge.exe
3616	msedge.exe
3616	msedge.exe
3616	msedge.exe
3616	msedge.exe
3616	msedge.exe
3616	msedge.exe
3616	msedge.exe
3616	msedge.exe
3616	msedge.exe
3616	msedge.exe
3616	msedge.exe
3616	msedge.exe
3616	msedge.exe
3616	msedge.exe
3616	msedge.exe
3616	msedge.exe
3616	msedge.exe
3616	msedge.exe
3616	msedge.exe
3616	msedge.exe
3616	msedge.exe
3616	msedge.exe

Suspicious use of SendNotifyMessage 16 IoCs

pid	Process
3616	msedge.exe
3616	msedge.exe
3616	msedge.exe
3616	msedge.exe
3616	msedge.exe
3616	msedge.exe
3616	msedge.exe
3616	msedge.exe
3616	msedge.exe
3616	msedge.exe
3616	msedge.exe
3616	msedge.exe
3616	msedge.exe
3616	msedge.exe
3616	msedge.exe
3616	msedge.exe

Suspicious use of WriteProcessMemory 36 IoCs

description	pid	Process	procid_target
PID 3616 wrote to memory of 5444	3616	msedge.exe	88
PID 3616 wrote to memory of 2808	3616	msedge.exe	89
PID 3616 wrote to memory of 1156	3616	msedge.exe	90
PID 3616 wrote to memory of 2808	3616	msedge.exe	89
PID 3616 wrote to memory of 2808	3616	msedge.exe	89
PID 3616 wrote to memory of 3736	3616	msedge.exe	91
PID 3616 wrote to memory of 3736	3616	msedge.exe	91
PID 3616 wrote to memory of 3888	3616	msedge.exe	94
PID 3616 wrote to memory of 5196	3616	msedge.exe	93
PID 3616 wrote to memory of 3888	3616	msedge.exe	94
PID 3616 wrote to memory of 3888	3616	msedge.exe	94
PID 3616 wrote to memory of 5196	3616	msedge.exe	93
PID 3616 wrote to memory of 5196	3616	msedge.exe	93
PID 3616 wrote to memory of 5088	3616	msedge.exe	95
PID 3616 wrote to memory of 1104	3616	msedge.exe	96
PID 3616 wrote to memory of 5088	3616	msedge.exe	95
PID 3616 wrote to memory of 5088	3616	msedge.exe	95
PID 3616 wrote to memory of 1104	3616	msedge.exe	96
PID 3616 wrote to memory of 1104	3616	msedge.exe	96
PID 3616 wrote to memory of 1408	3616	msedge.exe	97
PID 3616 wrote to memory of 1408	3616	msedge.exe	97
PID 3616 wrote to memory of 1408	3616	msedge.exe	97
PID 3616 wrote to memory of 4460	3616	msedge.exe	98
PID 3616 wrote to memory of 4460	3616	msedge.exe	98
PID 3616 wrote to memory of 4460	3616	msedge.exe	98
PID 3616 wrote to memory of 6016	3616	msedge.exe	101
PID 3616 wrote to memory of 1980	3616	msedge.exe	100
PID 3616 wrote to memory of 6016	3616	msedge.exe	101
PID 3616 wrote to memory of 1980	3616	msedge.exe	100
PID 3616 wrote to memory of 1280	3616	msedge.exe	103
PID 3616 wrote to memory of 124	3616	msedge.exe	107
PID 3616 wrote to memory of 248	3616	msedge.exe	108
PID 3616 wrote to memory of 252	3616	msedge.exe	109
PID 3616 wrote to memory of 1440	3616	msedge.exe	110
PID 3616 wrote to memory of 1440	3616	msedge.exe	110
PID 3616 wrote to memory of 5096	3616	msedge.exe	112

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument C:\Users\Admin\AppData\Local\Temp\adgf49.html
1⤵
- Drops file in Windows directory
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3616
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x260,0x264,0x268,0x25c,0x288,0x7ffa6bd2c188,0x7ffa6bd2c194,0x7ffa6bd2c1a0
  2⤵
  PID:5444
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1584,i,2102741604333130520,14784645473527632216,262144 --field-trial-handle=2252,i,10690772646134741055,12554623515085374072,262144 --variations-seed-version --mojo-platform-channel-handle=2248 /prefetch:2
  2⤵
  PID:2808
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1880,i,16846009061116807390,1836610572346291651,524288 --field-trial-handle=2252,i,10690772646134741055,12554623515085374072,262144 --variations-seed-version --mojo-platform-channel-handle=3196 /prefetch:11
  2⤵
  - System Time Discovery
  PID:1156
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2488,i,12982639343810933341,2304059950838639977,524288 --field-trial-handle=2252,i,10690772646134741055,12554623515085374072,262144 --variations-seed-version --mojo-platform-channel-handle=3204 /prefetch:13
  2⤵
  PID:3736
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3564,i,6345780342737844634,6555605874152442967,2097152 --field-trial-handle=2252,i,10690772646134741055,12554623515085374072,262144 --variations-seed-version --mojo-platform-channel-handle=3620 /prefetch:1
  2⤵
  PID:5196
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3592,i,12117389242273110077,14002773613120234220,2097152 --field-trial-handle=2252,i,10690772646134741055,12554623515085374072,262144 --variations-seed-version --mojo-platform-channel-handle=3612 /prefetch:1
  2⤵
  PID:3888
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4220,i,9450180657704897426,10570561506155937208,2097152 --field-trial-handle=2252,i,10690772646134741055,12554623515085374072,262144 --variations-seed-version --mojo-platform-channel-handle=4848 /prefetch:1
  2⤵
  PID:5088
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4264,i,16373679463327486747,7939860918273967904,2097152 --field-trial-handle=2252,i,10690772646134741055,12554623515085374072,262144 --variations-seed-version --mojo-platform-channel-handle=4900 /prefetch:9
  2⤵
  PID:1104
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=5252,i,4340649292715018403,2627948794156747692,2097152 --field-trial-handle=2252,i,10690772646134741055,12554623515085374072,262144 --variations-seed-version --mojo-platform-channel-handle=5284 /prefetch:1
  2⤵
  PID:1408
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --always-read-main-dll --metrics-shmem-handle=3596,i,8882996093077295764,9527307586656866301,2097152 --field-trial-handle=2252,i,10690772646134741055,12554623515085374072,262144 --variations-seed-version --mojo-platform-channel-handle=1628 /prefetch:1
  2⤵
  PID:4460
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4968,i,5343862464032071933,1676502641688443085,524288 --field-trial-handle=2252,i,10690772646134741055,12554623515085374072,262144 --variations-seed-version --mojo-platform-channel-handle=4832 /prefetch:14
  2⤵
  PID:1980
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4872,i,13558805378473865068,2056869979264091900,524288 --field-trial-handle=2252,i,10690772646134741055,12554623515085374072,262144 --variations-seed-version --mojo-platform-channel-handle=5008 /prefetch:14
  2⤵
  PID:6016
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6236,i,9084420362866124815,4731357439140417057,524288 --field-trial-handle=2252,i,10690772646134741055,12554623515085374072,262144 --variations-seed-version --mojo-platform-channel-handle=6264 /prefetch:14
  2⤵
  PID:2144
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6236,i,9084420362866124815,4731357439140417057,524288 --field-trial-handle=2252,i,10690772646134741055,12554623515085374072,262144 --variations-seed-version --mojo-platform-channel-handle=6264 /prefetch:14
  2⤵
  PID:1280
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4992,i,15039754643860938819,6796272646229210439,524288 --field-trial-handle=2252,i,10690772646134741055,12554623515085374072,262144 --variations-seed-version --mojo-platform-channel-handle=5184 /prefetch:14
  2⤵
  PID:124
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6812,i,17261440089198152843,7328921356887294709,524288 --field-trial-handle=2252,i,10690772646134741055,12554623515085374072,262144 --variations-seed-version --mojo-platform-channel-handle=4884 /prefetch:14
  2⤵
  PID:248
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6852,i,14663830061529382857,6537007050881851044,524288 --field-trial-handle=2252,i,10690772646134741055,12554623515085374072,262144 --variations-seed-version --mojo-platform-channel-handle=5112 /prefetch:14
  2⤵
  PID:252
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4424,i,12237314624048574470,9355794284452367891,524288 --field-trial-handle=2252,i,10690772646134741055,12554623515085374072,262144 --variations-seed-version --mojo-platform-channel-handle=4420 /prefetch:14
  2⤵
  PID:1440
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=5892,i,17938634272754684303,17448220505893296106,262144 --field-trial-handle=2252,i,10690772646134741055,12554623515085374072,262144 --variations-seed-version --mojo-platform-channel-handle=5932 /prefetch:10
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5096

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:5568

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:3104

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 cffda89706c34029bbadb3a079f8166927ce29a27926faf81be0941753fa411c
MD5 7cdea7179a599d50436be1171f9511c2
SHA1 6d8054f3ef2c68bd8edc0e0a0c209a8d0ec96169
SHA512 9254b7cacbb6da2f3991af0c9a702b61e8ea1514e5a421096b8814aba7d20757eb9270096433d7132ac27e348f1f0dafca2c9bdfe53b1301eac088ad262db76a
TLSH
T14BD080F53F45BA05D4471472C5105620513FC44138C6D609B171C50DDDA4DC0FBD6597
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 00fbb63799d26e9a7e30ff53840386023c5150d62b9ea487041ad388db361544
MD5 447de69b347844c29cf7a3b3f5e89252
SHA1 67ad860b72f4cf3188b263680869e8d3e2f79164
SHA512 b8977c20ec2389237c40a065ee9041a0ba55bc2336c4da14ff107c76ebafa289f5512cf0cafa740524f3299ee4cacddcee021abb68d7450550e6d21aa04cbdae
TLSH
T17ED080F13F45B905D4471476C5105620513FC44124C6D609B271C50DDDA4DC0FBD5593
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 ae55e97f91b821b03d443904db6aeb6947d0075b5cfb93deef580431c6dda81f
MD5 1d35abaa139c115ded0829b16d1ed3db
SHA1 3051e6aa469b0d3f6e285900e88ba2416aaf62ab
SHA512 b1e2b4a0921769c4d327e3ec80fe3e166f5512d917af605a0e399821b84b84c7a94036649b333b666dd75b9d7c45b40ac1c869976e943093130701f954b16506
TLSH
T1C261605C019104AEDF254674A3E1A3DA37BC5F4EAAD7FEFA40B05336A8BE7C89440714
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe593118.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe593118.TMP
Size 3KB
SHA256 535ced1f0933b715ef5b212b20f2c35fc6be55986f74a3c94fa7ef36746c516a
MD5 7e04281b0dca6f027bbf58c891fc79ec
SHA1 f43e4574d6997d32fb5672f71e2d5ac93e9cf575
SHA512 b05326b062f9d9bc3eef78ebc10e3785f4991f46641d75a4c0768243afe64e4b57099d8ae4f39989ef4ab7df950aead4470d0c039423f8bc8bef6e2864f4c921
TLSH
T19861805C029104AEDF254674A3E1A3DA37BC9F4E6AD7FEFA40B0533668BA7C88440714
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

HubApps

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\HubApps
Size 106KB
SHA256 eb2fd7422436fff93f6be09df3294b26cdb7afd18e6aa94dcdc0f208db78b2ed
MD5 25dca813dd764f2197142ef84bc5ce66
SHA1 8d6aefb01ee9f6d1fb0cfd89326cfe35af53a53d
SHA512 a9c8cd547c874b7b69cbb3a0c8214f43837911e522db768dcd075d23d05acfd7122cf2bcad281ea745025e4fb67cc9061b79f9dc1288ac1a113bd0d961841d43
SSDEEP 1536:IfEEtnH74ohBGZqW3iPPDuVvpBI/SvtZsA62UYPq:BuHSRhPjU1
TLSH
T154B35226D6A54C6B01F16264EC794382F325436F9282A82F3B7C5D5C2FBD93A6502F7C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 66e871b107b6eedc99687ef1e64c67f40d57965aca9a571ecc54f4d15f4de415
MD5 71862557d0b95f68e857fa02bcaf8155
SHA1 99a7e06cab04eadb52116e7e26b1820be1b8aa07
SHA512 4daf7cfd5b2cf01a720582e8233d184dd0262cb46d854583459c374a7660556d8bf8575634a915909ed861b5d39926e775ad151b45b0da519a198e78d883f667
TLSH
T191518CB7C2E8876E880156F0BB246E2BDE2D0959432C3C5689E4EF0F57E24B1E20165F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 d6156b1b999b2e7d439a3da6f990e6ef622b3ddd25fb57b61144f113d47feb1f
MD5 a51cccbd32b4cd81d3e33a80c20d3b4a
SHA1 61d9b566db0b8b4b71caa36dad05aca894e6ac75
SHA512 66b360c2b0a15b2bd0603ce30e4688ee1923226141c2851487b75a05ba511d93b6b090f0b0ac2bb71f74ffcfb14e655191ba1b38aa4d6dd440989ddeccbb5119
SSDEEP 192:sxRkRHyM/jK1Ml8wFs/f0sSC9cTdVzoA8p4fY/g6+WNIYbzjoG+IgIJ:sxRk5bs/f0sP9W4KY/5Ik6s
TLSH
T1B752DA156A34597B8CDBE20DFA517F53D6F81573B2901E48AAFCCA0C00E6ADD621382F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 59882e4bae5370c83151126acbf78771cd27f893649fe18fb439ec004fec28a7
MD5 9d5320a75702ee7430655566a7f239b2
SHA1 f01b169bd40612cab275e4b3d35d7dbc480ccf66
SHA512 d7b03d49c48294e1bd2db0799480cf16d1f1d36eadc9618f3b254544e29d549c67899acb5518f1e51ed23a2db6c1bb609aaa1553ffc3ba8d42ae0869a8fee3a5
SSDEEP 192:sxRbRHyM/jK1Ml8wFs/f0skC9cTdVzoA8p4fY/g6+WNIYbzjoG+IgDIJ:sxRb5bs/f0st9W4KY/5Ik6Y
TLSH
T17652C915AA34597B8CDBD21DFA517F53D6F81573B2901E48AAFCCA0C00E6ADD621382F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 df91ee79d5f847b8d52ad13ac77df3b923ef3c867d13b7fbc0e2d988c875d6ee
MD5 a783c7cd2d015c180a0e6b709339b968
SHA1 2eee5ea5b700642842b4bdcf553b55251720d135
SHA512 7ef4fc22503275aa2caa149cb6eb8028eaf022e0834e89d541c0926a9e28dbb5d4184ab3f1dfc383b0faaaa18446ca0fef39699e42fa52bdeb531b70f62e8827
SSDEEP 192:sxRbRHyM/jK1Ml8UQsFs/f0skClcTdVzoA8pefY/g6+WNIYbjjoG+IgDaJ:sxRb5q6s/f0stlW4sY/5Iy6S
TLSH
T19A62B915A62499778CDBE21DF6517F53D6F81573B2901E48AAFCCA0C00E6ADD621382F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 27KB
SHA256 e6633c2d2b34a3220e6b1052b70f0fb2a7b1b4467fd6bfe73017010332ddf89e
MD5 6873a33e18d34f5d579c8dfa1791cb56
SHA1 2a2e72c7dc219928c44526f6ffb5e8d075dff8a2
SHA512 7c8f00f8a547b7d594f9ebf9df6d50c2ba7c5cf7e3d54301ca2a0ffd5553cf6bdf96b899c52961e0f78501e7cb163bc94f129a6af726f8fd7e425c0e537d7d2b
SSDEEP 768:BcfLYDWg5tfnq8F1+UoAYDCx9Tuqh0VfUC9xbog/OVZLO/Uro4XtQnu:BcfLYDWg5tfnqu1ja8K//49Qu
TLSH
T181C20B2B640CC77E4F844E6DEC29BED76DE801CB97988D5447EA890C03C67EB521A4DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 88f8caa0e721d4657a5a8c719b8f9298bc4e2c77a453948cc63355a88eea2616
MD5 4d5f5ed3f2a9bfeb5db6edb256cc69f4
SHA1 3f977e134c10b3bd07c262e43997048cc3ccd15d
SHA512 223ace4aea3ce15e2136812ad9a57ea58b9dad9da0a26a2f5a7e91445e07122d62864365b7e59e0a316ba97f5cff5360babe3b219e380685ddda6ed286f4182f
SSDEEP 48:KopIBKqUMDyOboBtbxRheN+8IblhKoIgbh8TxZWl2fItKA04Lyl:KopeKqUKCoAK9msf6KA0mq
TLSH
T1BF91210535BE221038BD650CA2A5955E624134737217EA3F3FBC20D60E6BE425EFDEE9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

79ab7d32-2571-4a72-9e95-fdb5cfe3f305.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\79ab7d32-2571-4a72-9e95-fdb5cfe3f305.tmp
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 35KB
SHA256 61ba6b1e25eea4f022c894d045ba500cddf24983dbe25fd6a7f6738008c395cd
MD5 a59282caf24cfd0a6a3a198eba80ea8f
SHA1 6e56f8f1ebbb6de9720728828fcf38eeb2cbb026
SHA512 b033e57671b86eca29d58f0bffde4d7d245d80419f326cacea9a641d318ff6e8df2de37d798f1ab6a1e3781f0ec8729f962040452d4d6bcec8f05cdc5da5c816
SSDEEP 768:jj+9e3UXaNfFyf+PfEOd62tbnuGfD2/+0Ga9vl:m9e3AEf8fAfEOd62tbnxK/N9vl
TLSH
T134F2CF32EC214D638CE29599F10A3B87BEF84663E2C82B4898DD1F0D09D779C634B817
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 37KB
SHA256 edb7a9c624c96f6426ae4a2f3d1baeea5d43e3bd61a2ef4e500dc6ca0108cd8a
MD5 24630685daec2c76e00e6d68b671b4d6
SHA1 3d5beb8dc4c0760d5edc3e3ff36e7513978efc9d
SHA512 70049efbe949cc5ff639541b03776b41285356ee8e98cf85a010cb19d8fc8ee20fccede42b8932ff1747e26a673b9f9d80ecab2bb13393379f57c4cfce145112
SSDEEP 768:/F1j+9u3/wg0XaNfFyf+PfEbdi2tbnuGfD2/+0Ga9vl:29u3uEf8fAfEbdi2tbnxK/N9vl
TLSH
T13603BE33DC5489779DF29A99F20A3747AEF402A3D2C86A88AACD5E0D04D77DC534BC16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 35KB
SHA256 d20572f43ee939a60db09a1d9b2c44e0015e571257c88d7ef1a5ab3f271db31d
MD5 cb883b7878ba5c78a14e91aa4130f14b
SHA1 fbd7d22f3ae49a1d2be57d34c500b8e6fbe32a08
SHA512 59cd8b0f5dc2f3a67a520445c14b47fbba5957f52a9b5f7727928f92898a2600ef94139897eed3afad5cc1b502763f09b71c440e54e25948855b3e17b59b92a8
SSDEEP 768:Fj+9e3RXaNfFyf+PfEOd62tbnuGfD2/+0Ga9vl:w9e3xEf8fAfEOd62tbnxK/N9vl
TLSH
T1FFF2BF32EC254D639CE29599F10A3B877EF84663E2C82B4898DD1F0D09D779D634B81B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 41KB
SHA256 e7c0cad049a5ce559a3a10fbbfb0fb9d25641761d30efc6230eff5b93959a4e9
MD5 9f745ad99849d30ec9105592945b907b
SHA1 519e9e8f98bc873d3f0cccb5ad0b79c30270fd4f
SHA512 282768ef5ef127c62ceddddaa740a7baec8a7e72fbde2f2da536947dbceab4f226f99109092ca7bbc7bd30b45685c28ddd8dce334b6c39feba2fc744335ccb57
SSDEEP 768:KjaeqD4MlshiLdMmA3iNfFyf+PfEOd62tbnuGfD2/+0GatTW:KqcjhIdMz3Mf8fAfEOd62tbnxK/Nw
TLSH
T16213B036DC644C638CB26595B2067B93BFF446A3D3C93A9898DD1A0D05E73DD224B827
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 1350c8b5ff357ed2897b43fb977535c0159d5747ef7ffdb7900e6cafb2546282
MD5 129dbaaf8d6b9834eeed835244dcd74d
SHA1 06abfd974d0283f0906ac9061dc1f86f4ca70c24
SHA512 e4b790397c672eff0ef55e8b3f8b36196b953154ef5f8bf5fb2ded2acd6ccbc7e3b348bfc5687eb56b8bc887109d053170c475ef499a7dc8f31e0ef438c0b223
SSDEEP 768:ajaeqD4MlshiLdMms39f9fFyf+S62tbnuGfTJ+ApXpfTS:aqcjhIdMD39lf8fB62tbnxl+KXs
TLSH
T19203BF3AE85408739CB3A585B2467B937EF442A3D7C43B98D8DD1A0D02E76CD634742B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\metadata.json
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download