b30093b98553d8e426554d2428202c6955c754f80c826a9c5ccb3de08c1b00f1

Analysis

max time kernel
148s
max time network
130s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
21/07/2026, 12:22

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
fontawesome-webfont.html
Size 4KB
Sample260721-pj2s8abl8t
SHA256 b30093b98553d8e426554d2428202c6955c754f80c826a9c5ccb3de08c1b00f1
MD5 8609fed4a5b03fde22417c0cd604fcbd
SHA1 e870c713e64cdab28b6efe0ec4cf11fb5eb088ac
SHA512 1162095f9489a0ac1112b76b04fac295bbc59ba52ca5fd26ecaefb40326ef4bb1c0db34d6780523cd55d7ffb57df0187dd8a63aaed68e99097c7f6c574caa0ee
SSDEEP 96:1j9jwIjYj5jDK/D5DMFWC84ZqXKHvpIkdlv7RslvaQxvbK:1j9jhjYj9K/VoWntaHvFdlv7qlCejK
TLSH
T10A917326BAFD217E10A3816226EC63487EB0C513C6A705A076ACC1391F9FF59FE171C0
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
2020	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134291102172436342"	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-3797332335-34111092-3597280141-1000\{F79C8A00-FB8E-4B09-8ACC-A4C5F3495AA3}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2544	msedge.exe
2544	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
3600	msedge.exe
3600	msedge.exe
3600	msedge.exe
3600	msedge.exe
3600	msedge.exe

Suspicious use of FindShellTrayWindow 33 IoCs

pid	Process
3600	msedge.exe
3600	msedge.exe
3600	msedge.exe
3600	msedge.exe
3600	msedge.exe
3600	msedge.exe
3600	msedge.exe
3600	msedge.exe
3600	msedge.exe
3600	msedge.exe
3600	msedge.exe
3600	msedge.exe
3600	msedge.exe
3600	msedge.exe
3600	msedge.exe
3600	msedge.exe
3600	msedge.exe
3600	msedge.exe
3600	msedge.exe
3600	msedge.exe
3600	msedge.exe
3600	msedge.exe
3600	msedge.exe
3600	msedge.exe
3600	msedge.exe
3600	msedge.exe
3600	msedge.exe
3600	msedge.exe
3600	msedge.exe
3600	msedge.exe
3600	msedge.exe
3600	msedge.exe
3600	msedge.exe

Suspicious use of SendNotifyMessage 16 IoCs

pid	Process
3600	msedge.exe
3600	msedge.exe
3600	msedge.exe
3600	msedge.exe
3600	msedge.exe
3600	msedge.exe
3600	msedge.exe
3600	msedge.exe
3600	msedge.exe
3600	msedge.exe
3600	msedge.exe
3600	msedge.exe
3600	msedge.exe
3600	msedge.exe
3600	msedge.exe
3600	msedge.exe

Suspicious use of WriteProcessMemory 30 IoCs

description	pid	Process	procid_target
PID 3600 wrote to memory of 3548	3600	msedge.exe	88
PID 3600 wrote to memory of 4660	3600	msedge.exe	90
PID 3600 wrote to memory of 2020	3600	msedge.exe	92
PID 3600 wrote to memory of 4660	3600	msedge.exe	90
PID 3600 wrote to memory of 4660	3600	msedge.exe	90
PID 3600 wrote to memory of 960	3600	msedge.exe	93
PID 3600 wrote to memory of 960	3600	msedge.exe	93
PID 3600 wrote to memory of 3304	3600	msedge.exe	94
PID 3600 wrote to memory of 3304	3600	msedge.exe	94
PID 3600 wrote to memory of 3376	3600	msedge.exe	95
PID 3600 wrote to memory of 3304	3600	msedge.exe	94
PID 3600 wrote to memory of 3376	3600	msedge.exe	95
PID 3600 wrote to memory of 3376	3600	msedge.exe	95
PID 3600 wrote to memory of 4288	3600	msedge.exe	96
PID 3600 wrote to memory of 4288	3600	msedge.exe	96
PID 3600 wrote to memory of 4288	3600	msedge.exe	96
PID 3600 wrote to memory of 3160	3600	msedge.exe	97
PID 3600 wrote to memory of 3160	3600	msedge.exe	97
PID 3600 wrote to memory of 3160	3600	msedge.exe	97
PID 3600 wrote to memory of 3192	3600	msedge.exe	99
PID 3600 wrote to memory of 4424	3600	msedge.exe	100
PID 3600 wrote to memory of 3192	3600	msedge.exe	99
PID 3600 wrote to memory of 4424	3600	msedge.exe	100
PID 3600 wrote to memory of 5136	3600	msedge.exe	102
PID 3600 wrote to memory of 5020	3600	msedge.exe	106
PID 3600 wrote to memory of 3232	3600	msedge.exe	107
PID 3600 wrote to memory of 4116	3600	msedge.exe	108
PID 3600 wrote to memory of 108	3600	msedge.exe	109
PID 3600 wrote to memory of 108	3600	msedge.exe	109
PID 3600 wrote to memory of 2544	3600	msedge.exe	111

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument C:\Users\Admin\AppData\Local\Temp\fontawesome-webfont.html
1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3600
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x260,0x264,0x268,0x25c,0x288,0x7ffa5ae5c188,0x7ffa5ae5c194,0x7ffa5ae5c1a0
  2⤵
  PID:3548
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1640,i,9553755568871610366,6634599507503844191,262144 --field-trial-handle=2432,i,8420092833587283308,6248900902286304102,262144 --variations-seed-version --mojo-platform-channel-handle=2424 /prefetch:2
  2⤵
  PID:4660
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1832,i,6922574439323971717,8659937722533624910,524288 --field-trial-handle=2432,i,8420092833587283308,6248900902286304102,262144 --variations-seed-version --mojo-platform-channel-handle=2460 /prefetch:11
  2⤵
  - System Time Discovery
  PID:2020
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2500,i,11382677591055504957,9327732320505282119,524288 --field-trial-handle=2432,i,8420092833587283308,6248900902286304102,262144 --variations-seed-version --mojo-platform-channel-handle=3364 /prefetch:13
  2⤵
  PID:960
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3524,i,11762282074498538571,6807798698558374471,2097152 --field-trial-handle=2432,i,8420092833587283308,6248900902286304102,262144 --variations-seed-version --mojo-platform-channel-handle=3528 /prefetch:1
  2⤵
  PID:3304
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3584,i,2489037842576767586,17601220928453137126,2097152 --field-trial-handle=2432,i,8420092833587283308,6248900902286304102,262144 --variations-seed-version --mojo-platform-channel-handle=3620 /prefetch:1
  2⤵
  PID:3376
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4248,i,4947962007679372819,13513223471883050361,2097152 --field-trial-handle=2432,i,8420092833587283308,6248900902286304102,262144 --variations-seed-version --mojo-platform-channel-handle=4256 /prefetch:1
  2⤵
  PID:4288
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4312,i,17404037331849494915,15841117137027812244,2097152 --field-trial-handle=2432,i,8420092833587283308,6248900902286304102,262144 --variations-seed-version --mojo-platform-channel-handle=4288 /prefetch:9
  2⤵
  PID:3160
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5380,i,13501555124204079349,2769115607373819542,524288 --field-trial-handle=2432,i,8420092833587283308,6248900902286304102,262144 --variations-seed-version --mojo-platform-channel-handle=5416 /prefetch:14
  2⤵
  PID:3192
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5376,i,17309156876302960403,4556319968505791421,524288 --field-trial-handle=2432,i,8420092833587283308,6248900902286304102,262144 --variations-seed-version --mojo-platform-channel-handle=5384 /prefetch:14
  2⤵
  PID:4424
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5944,i,5071775084457220027,6830181655540598890,524288 --field-trial-handle=2432,i,8420092833587283308,6248900902286304102,262144 --variations-seed-version --mojo-platform-channel-handle=5964 /prefetch:14
  2⤵
  PID:4516
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5944,i,5071775084457220027,6830181655540598890,524288 --field-trial-handle=2432,i,8420092833587283308,6248900902286304102,262144 --variations-seed-version --mojo-platform-channel-handle=5964 /prefetch:14
  2⤵
  PID:5136
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5280,i,2140690986405590893,17340289584530612982,524288 --field-trial-handle=2432,i,8420092833587283308,6248900902286304102,262144 --variations-seed-version --mojo-platform-channel-handle=5304 /prefetch:14
  2⤵
  PID:5020
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4320,i,9800295203364252358,11637286530027724098,524288 --field-trial-handle=2432,i,8420092833587283308,6248900902286304102,262144 --variations-seed-version --mojo-platform-channel-handle=4324 /prefetch:14
  2⤵
  PID:3232
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4900,i,3921344684519606453,8796617322148509069,524288 --field-trial-handle=2432,i,8420092833587283308,6248900902286304102,262144 --variations-seed-version --mojo-platform-channel-handle=5068 /prefetch:14
  2⤵
  PID:4116
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5500,i,8596524700254818565,10506601014320679598,524288 --field-trial-handle=2432,i,8420092833587283308,6248900902286304102,262144 --variations-seed-version --mojo-platform-channel-handle=5492 /prefetch:14
  2⤵
  PID:108
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=5536,i,11004791653354699371,8224674637717182097,262144 --field-trial-handle=2432,i,8420092833587283308,6248900902286304102,262144 --variations-seed-version --mojo-platform-channel-handle=2132 /prefetch:10
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2544

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:4116

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:5324

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 94dec02053c5653bb99c1c0743dc42d0d9a1b45570125bb35bd9b56d56a0c898
MD5 80621954e39909665113acb49efb7d24
SHA1 96c4d9a15a5b8a59987cdafca36273b3e438ba0f
SHA512 3db0d51e9ffd617c5dd28fd5eb72406d4f07ed05761c5d5de7dc9031337da8098941f2be28999786128e9c622da3bbbb98086e8185db67c294d23cc06481e8d1
TLSH
T108D097A432627507E71810B2A8224300B35688003A96C101C040A30E8E2E0A06BDA2CA
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 e413e02b9e80ee8d76d52c1043fc32251e2d7634d4b2fbd970df9ace9d91831a
MD5 22959b3a06a842ac30237dd57e8a3801
SHA1 0b7c28071a592034aa2607038000f085c7bb6362
SHA512 644add9ab912ad7fdfc55bc7a1b84482c75cc9bc69a59d169bae63a0400619d999846ebbadb0ef2bd6d35c2bd08a5f07053b600874dd5dfcbda7e8f3076131fe
TLSH
T1A5D02BE476408A0CC980203335F6524092018910D801D1480040B325CC845C1257F0DF
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 8aaa68aad07ba45abe53bd513aa5f7e7b21bd1b29db6e1d5c1e0a79a5f4eb890
MD5 74012bbce5fada7634c1da1b567562b3
SHA1 09db27f38f27e35986cfd407b57f6f83c8fc59f8
SHA512 c1a6a98f972793c84274c29552107bfe07b775c7c8121e5fdf137ebf9a7cc3f4eb43fe9eadfc842e7b92ca7281bbcea3d660bdd8fc9adc56add068510c41e48d
TLSH
T1FBD02BE07640890CC980203335F75240920189108401D1480040F335CC845C1257E0CF
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 2KB
SHA256 089156310baf9c70a312e60e4e9db47f82eee49460cff85b2cc59e34be9ce939
MD5 62138c4e334fe96701c9e683498ce409
SHA1 c82020ad8ae0784981876b0390fa1c09e14a602d
SHA512 08d72c242bc3513b4f2b94a662da555d3c5503dde5e621639cd589e121bb99935a87f86782ab77521acd85e8f44c031bafbfb16ea0f2846b8d561501650edbd2
TLSH
T146516F1D133A3DDDE3A50AF12EE1D6A43BFD88AE02076E1062442DFCDA42F3841D21A7
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe59d74b.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe59d74b.TMP
Size 2KB
SHA256 ed8f9846a574ae8aab93e0db36b8a2f869e1739de7727f986d32b70a50e54cb5
MD5 fede15ead630f359887986d71ed1bf2d
SHA1 41942ed8c073076805d9f477e1997c82a1ba5973
SHA512 ea050e14cf4c536260bf4d8d759856a72f7f3c4788a3839ab0186667b1ec14a7a73b91229de43620b7b7e370daff21aa2a9f58bedefe918ab8c7e5e68badccd8
TLSH
T10E51505D133A3DDCE3A406F16EE1D6643BFD88AE02072E1062442DFCDA42F3851D21A7
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7db22788-0824-4137-9f8d-92ca234eec49.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\7db22788-0824-4137-9f8d-92ca234eec49.tmp
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 1KB
SHA256 06d14995b3838bc6f35eeb895993f9c271d0500c4445813265ca912ca65440a9
MD5 e3cd85708fdc3a09ddb28b6ddc2bd04c
SHA1 643be8e3b12538cfb9989f7d965e80488d36282c
SHA512 5264b9192640e35e33821ee26794129b0c3f4dabe930d820f32fe5ca3f3dccf7c29289dfd2bb30d4c955f14a559bf4831cc033a75e1db179cafe6734bd9fbf43
TLSH
T17C41BDF7C3E4D66D890156F0AA146E1BCE1D0915832C3C5AC9E4AF1B93E2471E141A5F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 9c3beb3a1cc1a1b2b564f8d32fad2012013399683452e84414652771a5fe6b9a
MD5 b3fa1145a3a4dab7b73baee939676a80
SHA1 08159276974742f281024864289011bc80d44471
SHA512 f8d092076f7255bc900e98084e728946db3cc2361d3d3ccb667c2ce84cc3b8a590322b74e10987b7817452d740319dec94a1af9f0ec3b4606a2e1931ea6326bb
SSDEEP 192:sxR1MgR0PbE6/fSMsqCZprQ5MC9zoA8p41y//g6+WNIYn8FhQyGsM4IgDVJ:sxR7eB/frszZnz//5ITHXr
TLSH
T19532A71AA968AD7B5CC7E21DBB55BF53D2F95032A1E41E48A7FC8B1C04E76CD220740B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 80d358f80c4858fe1f6a352ac99724218416e15f73a3afc903673b16b3b65920
MD5 a8a162bcb637cd5d8b530a158d577aba
SHA1 16a60f81ee8b37c786a98bb79d573abed1ed4298
SHA512 57500e39444002731e84566f8e9a2242a1922965efffa52258db0565bbcf864d70ed7156e04e6135309f21a2b1570de9157dbd2ec75afd48c18db395cafbbc00
SSDEEP 192:sxR1xgR0PbE6/fSMsJCWprQ5MC9zoA8p41y//g6+WNIYn83hQyGsM4IgIJ:sxREeB/frscWnz//5ITRXs
TLSH
T10132B81A6A28A83B5CC7D21DBB55BF53D6F95032A1E01E48A7FC871C04EB6CD220780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 120c27727ec96cc4fb69cb07ef97dbaeba738699f23acd533d20cca293ba330b
MD5 93f5313f3c5ff17b016270a0d06720fd
SHA1 8a0f79c30b768f11b4b4e4f70693eb8301f14774
SHA512 7f580dfc5c1810ff673f45411fea325ef00fdd92ef4173f1dd2ad5059f995769a2d28e1b27d16eb6d4df40eab3c934e8e35ae582ead553223012574f760c2512
SSDEEP 192:sxR1MgR0PbE6/fSMsqCWprQ5MC9zoA8p41y//g6+WNIYn83hQyGsM4IgDTJ:sxR7eB/frszWnz//5ITRXB
TLSH
T1BE32C81AAA28A97B5CC7D21DBB55BF53D6F95032A1E01E48A7FC971C04EB6CD220740F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 23KB
SHA256 0beeb8e07b6c3e55b67cc1c4e0a3dc02ddfd3c8027c2fe5e041500fe89eff3c5
MD5 01d993a9f930e310727aa1828fd3487b
SHA1 96ca9f90157637f58cf338ffb58ded2be1ffea49
SHA512 c9baf95ec7d6e1a120cb25fb290092f949a6bc21444cd26b16012d23701140172cd874abbabcb2614dca6855e5129673454d4abb1afc5c49945393f8a8093abc
SSDEEP 384:wum8dzAfCtgoSFf6MKhOObJ+UoAYDCx9TuqZz0VfUCh7xbog/OVU494oRPwrohMG:wb8dz6Wgouf6M8F1+UoAYDCx9Tuqh0Vs
TLSH
T128B2EC3B604DCB7E5F800AADEC19AFDB7D5802C79A988D4447FE990C03C77EA51194DA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 5KB
SHA256 4c1b9f900d57ef0a51328985a9980b02ae0af5d6bdf5548b4f9cd2e90e6d03b3
MD5 07d45abeaf65e6f96f6e48cef0fa1248
SHA1 8101af0379664a17ab7b4fc8b7f590afe186858c
SHA512 27eee3b8c254f4796ed3eb2be1e2d044720bf6174f6e2ced43676baba654810cd0bf9f57f0fe6476d74070048029a693f999ff0bfa62cc6a13f67144a986617c
SSDEEP 96:KRv4dZvtNhW528gBhK4Igvhc3f+BtiHKoKZKsK4KqK2K6KgWKeKDKzgKgKgK4K18:Cv4dZvtNs529BLIgvO3f+BtiHN6zn9XN
TLSH
T177C11414323B0644387DBA0985789D6AC5D2B4B2B45AA42F3BE843760F67E478DFD8CD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

9c3bab9a-009c-4b26-b085-9911c0851f68.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\9c3bab9a-009c-4b26-b085-9911c0851f68.tmp
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 41KB
SHA256 db81dba86879ecd20931dd67b247e6f62881ad28f3e42cde5762f6d0f6e0941c
MD5 6ec3976a720a31d94e3839e1c3ba5f2f
SHA1 2ce3f13c017aeadac424887dcdce4fa0a63c2182
SHA512 ca8923eddcd10101b7776ca00040a26529b0fb9debfcb7c2a42561f7fac26ef9f1a8470f754f53144e9f18ce19ac687644042dae618b5c4ef9a7bd696940bc63
SSDEEP 768:7rv+4UNbdm3u3DPDZIO0crzNzc4ReyIsPJMVcLCO7w/q:7bsbc3uJtc44bsRHCt/q
TLSH
T1C313BE36E828DD77ACE66286F10771437FF99527C2C91A94C9DE2F0C064B59E131B923
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 35KB
SHA256 ed9dce7861d85bec691bdb5ef990c17c68d8b825c2858a1b4973791e125cf7bb
MD5 72ad874d11f95e41c63a5954d905a842
SHA1 a64de10d1816eb826bd6ca0f0421da4ada991463
SHA512 ee1267a81eff907b943fec4b83666d79f1150ec6ec8b702ebb679ce845cae642263537a1b9f7b4aed1cfc8ad6fc5ea55fdd82be1eaba119e83b657b2257c10d7
SSDEEP 768:/j+9I383FPDZIO0crzNzc4ReyIsPJMVcLCO7w/Z:y9I38/tc44bsRHCt/Z
TLSH
T182F2BE36E825DC67ACE56786F6133242BEF58127C2C92E94C9DD7F0C028B69D431B823
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 37KB
SHA256 6dfd954507b221249a36a107fa01aaf7f09ef632c3f663bc2a44151316af4838
MD5 a417c3d29a98199d8923c72f072c4de9
SHA1 52def2f2ee4bab6690f60ebc9d2fffec17b57bee
SHA512 956506708e655ea608ab2ba99e72a0356bd848c827b5b3f3481a364ffdd6609b7bf16384d21842698dc1fb6c45d8cfec5379f08a498439a2b177c04ee42339e3
SSDEEP 768:IF1j+9J3UwgL3FPDZIO0crPNzc4ReyIsPJMVcLCO7w/Z:l9J3+Ttc44bsRHCt/Z
TLSH
T15503AE37E864CD6BACE95B86F6173242BEF54127C5C96E94D6CD6F0C024B29D031BC22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 35KB
SHA256 5484e4c3b45a44b4da1ab8bb0bb0f086b417bbdb4cef7d5873c78a7e3beb0c22
MD5 eaa2cb8c98c60c951f7b039b3036bb49
SHA1 7d5305c767435698218ce1bc684ec122bf7bcf73
SHA512 0b28cd2f09719aee7bf776ec77b3cebefc675ab1586846e69ebd364a28236bf631f29dab77805dfc12d6eb529d8e689007d24e0feb9796e0889597c135ae3555
SSDEEP 768:Qj+9I3t3FPDZIO0crzNzc4ReyIsPJMVcLCO7w/Z:v9I3t/tc44bsRHCt/Z
TLSH
T14FF2BE36E825DC67ACE56786B6133242BEF58527C2C92E94C9DD7F0C028B69D431B822
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 2722d7132667c9ff27983a2213db8d1d0e637ba99947bdb69b9468f93467f683
MD5 ea0dfb561064dc5deb9cba363fd8583e
SHA1 daaf5dc7962c5322fb6c3d1e3de698b8e00c1bf1
SHA512 051148ccebf3511f7d55c8ea3652628165e51af04e19656d6606069e58b545f71eed13162fea8e80bf634642c4eaf9a0f2bc90fb4da81086a28931a32f54fc33
SSDEEP 768:6rv+4UNbds3nVDZIO0cdNzc4ReyIsXHeVH1S5D:6bsbS3Vtc44bsXEH1Y
TLSH
T10403CE36E8688937ACF6A686B50B72533EF8512BC2D81ED4C5DE6F0C464B1DD130B923
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\metadata.json
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

memory/5136-169-0x00000205818A0000-0x0000020581AE1000-memory.dmp

Download