26e59ad1640f2dbf16b158283e4fc2dee3413d4a80cff25de2ea748187e46af3

Analysis

max time kernel
148s
max time network
154s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
23/07/2026, 00:19

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
sample.html
Size 5KB
Sample260723-amds8stsas
SHA256 26e59ad1640f2dbf16b158283e4fc2dee3413d4a80cff25de2ea748187e46af3
MD5 2130f43ee28e1d66f84a63ad3e8dfcb8
SHA1 3113470d448a063681594e173e1a1f4fcb4f77e5
SHA512 82e0c4ee2ab315489d9399fc87a8f524a5458993a09c6ee99bb38fa2591b99e96d96d5ebe18bf58c3d40f39ae56ea7bff116c86b8ba22e222cafe8077b12e399
SSDEEP 96:aAwkAZlcIfFKFvFYF4TvEVgUxwgUxuKxGwld9leRddhED0KMq:jiZltFKFvFYFBgUxwgUxuKxGwld9leRM
TLSH
T11BB113A8186354456123D22867DF17082438A513EA27DC2AB3ED764FCF51B8C9793BE7
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4660	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134292396654613420"	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-3797332335-34111092-3597280141-1000\{F0AEFF46-DE1C-4CB1-AFAB-50EF2B77AF93}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
5520	msedge.exe
5520	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
4880	msedge.exe
4880	msedge.exe
4880	msedge.exe
4880	msedge.exe
4880	msedge.exe

Suspicious use of FindShellTrayWindow 33 IoCs

pid	Process
4880	msedge.exe
4880	msedge.exe
4880	msedge.exe
4880	msedge.exe
4880	msedge.exe
4880	msedge.exe
4880	msedge.exe
4880	msedge.exe
4880	msedge.exe
4880	msedge.exe
4880	msedge.exe
4880	msedge.exe
4880	msedge.exe
4880	msedge.exe
4880	msedge.exe
4880	msedge.exe
4880	msedge.exe
4880	msedge.exe
4880	msedge.exe
4880	msedge.exe
4880	msedge.exe
4880	msedge.exe
4880	msedge.exe
4880	msedge.exe
4880	msedge.exe
4880	msedge.exe
4880	msedge.exe
4880	msedge.exe
4880	msedge.exe
4880	msedge.exe
4880	msedge.exe
4880	msedge.exe
4880	msedge.exe

Suspicious use of SendNotifyMessage 16 IoCs

pid	Process
4880	msedge.exe
4880	msedge.exe
4880	msedge.exe
4880	msedge.exe
4880	msedge.exe
4880	msedge.exe
4880	msedge.exe
4880	msedge.exe
4880	msedge.exe
4880	msedge.exe
4880	msedge.exe
4880	msedge.exe
4880	msedge.exe
4880	msedge.exe
4880	msedge.exe
4880	msedge.exe

Suspicious use of WriteProcessMemory 30 IoCs

description	pid	Process	procid_target
PID 4880 wrote to memory of 3548	4880	msedge.exe	88
PID 4880 wrote to memory of 4660	4880	msedge.exe	90
PID 4880 wrote to memory of 3252	4880	msedge.exe	91
PID 4880 wrote to memory of 3252	4880	msedge.exe	91
PID 4880 wrote to memory of 2020	4880	msedge.exe	92
PID 4880 wrote to memory of 2020	4880	msedge.exe	92
PID 4880 wrote to memory of 2020	4880	msedge.exe	92
PID 4880 wrote to memory of 3764	4880	msedge.exe	94
PID 4880 wrote to memory of 3764	4880	msedge.exe	94
PID 4880 wrote to memory of 752	4880	msedge.exe	95
PID 4880 wrote to memory of 3764	4880	msedge.exe	94
PID 4880 wrote to memory of 752	4880	msedge.exe	95
PID 4880 wrote to memory of 752	4880	msedge.exe	95
PID 4880 wrote to memory of 2408	4880	msedge.exe	97
PID 4880 wrote to memory of 2700	4880	msedge.exe	96
PID 4880 wrote to memory of 2408	4880	msedge.exe	97
PID 4880 wrote to memory of 2408	4880	msedge.exe	97
PID 4880 wrote to memory of 2700	4880	msedge.exe	96
PID 4880 wrote to memory of 2700	4880	msedge.exe	96
PID 4880 wrote to memory of 2640	4880	msedge.exe	99
PID 4880 wrote to memory of 5420	4880	msedge.exe	100
PID 4880 wrote to memory of 2640	4880	msedge.exe	99
PID 4880 wrote to memory of 5420	4880	msedge.exe	100
PID 4880 wrote to memory of 4540	4880	msedge.exe	103
PID 4880 wrote to memory of 1128	4880	msedge.exe	106
PID 4880 wrote to memory of 2512	4880	msedge.exe	107
PID 4880 wrote to memory of 2976	4880	msedge.exe	108
PID 4880 wrote to memory of 6132	4880	msedge.exe	109
PID 4880 wrote to memory of 6132	4880	msedge.exe	109
PID 4880 wrote to memory of 5520	4880	msedge.exe	111

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument C:\Users\Admin\AppData\Local\Temp\sample.html
1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4880
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x260,0x264,0x268,0x238,0x27c,0x7ffa5ae5c188,0x7ffa5ae5c194,0x7ffa5ae5c1a0
  2⤵
  PID:3548
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1840,i,16365692210589861987,1569954452911466240,524288 --field-trial-handle=2176,i,1740330762697214993,11759017429642044647,262144 --variations-seed-version --mojo-platform-channel-handle=2692 /prefetch:11
  2⤵
  - System Time Discovery
  PID:4660
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2380,i,12332409644371936915,6630528902636071353,524288 --field-trial-handle=2176,i,1740330762697214993,11759017429642044647,262144 --variations-seed-version --mojo-platform-channel-handle=2704 /prefetch:13
  2⤵
  PID:3252
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1552,i,6902203246959511391,2324166543469456622,262144 --field-trial-handle=2176,i,1740330762697214993,11759017429642044647,262144 --variations-seed-version --mojo-platform-channel-handle=2172 /prefetch:2
  2⤵
  PID:2020
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3544,i,13085909710894570669,14616183263306137227,2097152 --field-trial-handle=2176,i,1740330762697214993,11759017429642044647,262144 --variations-seed-version --mojo-platform-channel-handle=3604 /prefetch:1
  2⤵
  PID:3764
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3584,i,11952688814464066711,1605283577260384029,2097152 --field-trial-handle=2176,i,1740330762697214993,11759017429642044647,262144 --variations-seed-version --mojo-platform-channel-handle=3652 /prefetch:1
  2⤵
  PID:752
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4368,i,535026458580623180,6546815784063449786,2097152 --field-trial-handle=2176,i,1740330762697214993,11759017429642044647,262144 --variations-seed-version --mojo-platform-channel-handle=4828 /prefetch:9
  2⤵
  PID:2700
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4372,i,5386208085912100354,17342092571325545375,2097152 --field-trial-handle=2176,i,1740330762697214993,11759017429642044647,262144 --variations-seed-version --mojo-platform-channel-handle=4824 /prefetch:1
  2⤵
  PID:2408
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5352,i,12560459805596375310,15700517153128764823,524288 --field-trial-handle=2176,i,1740330762697214993,11759017429642044647,262144 --variations-seed-version --mojo-platform-channel-handle=5356 /prefetch:14
  2⤵
  PID:2640
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5360,i,8510077571856964946,18423443679150128660,524288 --field-trial-handle=2176,i,1740330762697214993,11759017429642044647,262144 --variations-seed-version --mojo-platform-channel-handle=5384 /prefetch:14
  2⤵
  PID:5420
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6036,i,12670302781589717267,6966411462155806102,524288 --field-trial-handle=2176,i,1740330762697214993,11759017429642044647,262144 --variations-seed-version --mojo-platform-channel-handle=6060 /prefetch:14
  2⤵
  PID:5400
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6036,i,12670302781589717267,6966411462155806102,524288 --field-trial-handle=2176,i,1740330762697214993,11759017429642044647,262144 --variations-seed-version --mojo-platform-channel-handle=6060 /prefetch:14
  2⤵
  PID:4540
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5204,i,9664347271477290929,7847582897605650639,524288 --field-trial-handle=2176,i,1740330762697214993,11759017429642044647,262144 --variations-seed-version --mojo-platform-channel-handle=3540 /prefetch:14
  2⤵
  PID:1128
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5188,i,14741370903972555091,3602796361954379016,524288 --field-trial-handle=2176,i,1740330762697214993,11759017429642044647,262144 --variations-seed-version --mojo-platform-channel-handle=6060 /prefetch:14
  2⤵
  PID:2512
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5192,i,18356570546059873938,18230882824315902503,524288 --field-trial-handle=2176,i,1740330762697214993,11759017429642044647,262144 --variations-seed-version --mojo-platform-channel-handle=6504 /prefetch:14
  2⤵
  PID:2976
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5604,i,16782874370153372525,4170587313109710535,524288 --field-trial-handle=2176,i,1740330762697214993,11759017429642044647,262144 --variations-seed-version --mojo-platform-channel-handle=5592 /prefetch:14
  2⤵
  PID:6132
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6416,i,10042774681061137570,1771435587863152636,262144 --field-trial-handle=2176,i,1740330762697214993,11759017429642044647,262144 --variations-seed-version --mojo-platform-channel-handle=816 /prefetch:10
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5520

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:1816

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:5848

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 8aaa68aad07ba45abe53bd513aa5f7e7b21bd1b29db6e1d5c1e0a79a5f4eb890
MD5 74012bbce5fada7634c1da1b567562b3
SHA1 09db27f38f27e35986cfd407b57f6f83c8fc59f8
SHA512 c1a6a98f972793c84274c29552107bfe07b775c7c8121e5fdf137ebf9a7cc3f4eb43fe9eadfc842e7b92ca7281bbcea3d660bdd8fc9adc56add068510c41e48d
TLSH
T1FBD02BE07640890CC980203335F75240920189108401D1480040F335CC845C1257E0CF
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 e413e02b9e80ee8d76d52c1043fc32251e2d7634d4b2fbd970df9ace9d91831a
MD5 22959b3a06a842ac30237dd57e8a3801
SHA1 0b7c28071a592034aa2607038000f085c7bb6362
SHA512 644add9ab912ad7fdfc55bc7a1b84482c75cc9bc69a59d169bae63a0400619d999846ebbadb0ef2bd6d35c2bd08a5f07053b600874dd5dfcbda7e8f3076131fe
TLSH
T1A5D02BE476408A0CC980203335F6524092018910D801D1480040B325CC845C1257F0DF
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 2KB
SHA256 cd8ca6f254a38e8c8d19f559a4b1cbaa44b08ea79f8fef15974a14a5c32b1345
MD5 04bfb79f040a05ec7df2408f3ac45c0b
SHA1 68e3189ed232f5a08ccf92d7484d2c34f03b1bc8
SHA512 3bf552c5badc7a1a2bf0653f47e4a943016ce77faa7fac93787a2e7b04dcf8518f9f681293936f24399d5650fe6fe0828c308d6164921872e61416d8af4629b9
TLSH
T1CF516F1D133A3DDDE3A40AF12EE1D6A43BFD88AE02072E1062442DFCDA42F3851D21A7
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe59d96e.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe59d96e.TMP
Size 2KB
SHA256 7c458a7b301f501d4fe94badbfab3c14f77d62ef4365887d1942744633b387c4
MD5 896db7146a855e4022609943f07c9253
SHA1 660ed36128adeb20f1465fcbc3a5822ecde53fec
SHA512 a47ebbe87545c70e866511c7e48ef261b678847a038e5c0b282d93ad3783c2c3acfc8d2a6a4fa133ead344a41721b60e3010c140b1e3daae14fa780f93092fcb
TLSH
T18D51615D133A3DDCE3A406F16EE1D6643BFD889E02072E1062442DFCDA42F3851D21A7
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 1KB
SHA256 d1195fa9ce60b3756933e2c433eab5e76dcb2854d242c642058e69d9136a1681
MD5 b5a9e615d13b6d74a20f8f26dcdf2087
SHA1 9618ec2c66908dcaf1189cf57f3c613415a1de8e
SHA512 0d2bfa8d193854ca48b641f6a9625a4bbebac005001f1a04b68ae7bb266d55a7d78c034ee565be6f3e3b8e1de26637f046d272958a1f20e58210c3bf08ddd2aa
TLSH
T16D41CEF7C3E4967D890156F0AB146E1BCE2D0955832C3C5AC8E4AF1B93E3471E141A5F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 7d258baf6e8e2199708bf87d4bc5d08f013bc517cf5f238a20c0c0665e849395
MD5 388dbcebca077fee7fcfe2e53f5c444a
SHA1 4ccdcad36ba89f2916bb7e5a7dc65c92858e836d
SHA512 8d277405c8125490f28f50062f0fe69efbb0a5866468f07e35b4f71be890cc4828a562a67fd6415da541fef9bd72b983ec66f0181fafa749ef5e955ab1f4c141
SSDEEP 192:sxRERRbr/fPsJlQprQ5GzoA8p4A/g6+WNIYn89hIGEIgDDJ:sxRELr/fPsDQmJ/5IT/0B
TLSH
T14E32A61A6938A97B5CC7E21DFB15BF53E2F95032A1D01E48A6FC9B0C04E66CD520781F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 4656957e92a24b69c32c8d42c4eda5e92b60d553b5cad4a24207c42bba3b87b0
MD5 44e277ec4081b52353c38b3405731433
SHA1 613a8ec5cadeeca9338fd896e57862a6c4f79c92
SHA512 c61283ff00577c9967ce44e2c89913a624411cad5119c90642e69f2723a25e7b4c1a45d96439e0d00281060b537fb0e9c43a7cd9b9ecfcafc0948630af3d1b93
SSDEEP 192:sxRERRbr/fPsJlGprQ5GzoA8p4A/g6+WNIYn83hIGEIgDtJ:sxRELr/fPsDGmJ/5ITR0D
TLSH
T10732A61A6A78A97B4CC7D21DFB55BF53E6F95032A1D02E48A6FC9B0C04E66DD120780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 6e0a1fe55b35a80525e85515967b819c39b82351572680d2ea5a4096d846b3e0
MD5 258ae7588f821e0b28a2d435c258f4e4
SHA1 1c45f223906e597e63c7c63149fb8370bdff5370
SHA512 bca9661cac995869ed28f02cb7ed24bf6262475daa5aa36602968701479b76193f793344598fe1726d8c531efeb7a048a73796b81283899d7997fc6941ca141b
SSDEEP 192:sxRbRRbr/fPs3lGprQ5GzoA8p4A/g6+WNIYn83hIGEIgIJ:sxRbLr/fPsVGmJ/5ITR0s
TLSH
T13532A61A6A78A97B4CC7D21DFB15BF53E6F95032A1D42E48A6FC9B0C04E66DD120780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 23KB
SHA256 25167a1c3e371967bf6aaf1ff2c730e3b9f493158498907025ae6018a396ceee
MD5 925f0814c8f93ac5efc4f54544f946cd
SHA1 9b87dc5d3a9012d55a77cbd1d08f33690990b50e
SHA512 10f7878abaf210f2f21479cddb7e4ca020f32bdbb9ba7c1b8723c862ece26126bb5859f0b308a7a36cb645453e18f850a0099d66f687f4b0d356a00f44d4e906
SSDEEP 384:wum8dzAfCtgoSFf6MKhOObJ+UoAYDCx9TuqZz0VfUCh7xbog/OVU494oRPwrohMc:wb8dz6Wgouf6M8F1+UoAYDCx9Tuqh0VW
TLSH
T1A6B2EC3B604DCB7E5F800AADEC19AFDB7D9802C79A948D4447FE990C02C77EA51194DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 5KB
SHA256 a3fbf923546421bf1e804eebf53f9e808e37b892e31fc52bdf954d25855b5c4a
MD5 c91160d1e6f63e7779ca5b746e40eb81
SHA1 051c95339f5a1e42cf18827b6e555d6e3667cfbf
SHA512 09f1cf4313859dc85f8da91f509dce52b473e07f617d00b0c35b37670ed622d6a738164b99f307ee029ef983dda2a3b370034660b6162bcd2fbb43bb244d0046
SSDEEP 96:KRv4dZvtNhW528gBhK4Igvhc3f+BtiHKoKZKsK4KqK2K6KgWKeKDKzgKgKgK4K1h:Cv4dZvtNs529BLIgvO3f+BtiHN6zn9Xs
TLSH
T1D3B11410323B0644387DB60985789D6AC5D2B8B6B41AA42F37E803764F67E478DFD8CD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

4da6e2f2-035a-434c-b9c7-b4384b945d8c.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\4da6e2f2-035a-434c-b9c7-b4384b945d8c.tmp
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 35KB
SHA256 0ac29bb7e2a2c2c51cd8db93c898b8c9ba394262301e981c784e5e88f7e4c313
MD5 79a0b0db48f5ec1ceff1287cf31f03ca
SHA1 71398bd7f9899ad05a25de870df4f359313d450e
SHA512 b49f58b451455d60170539f7e3b48458feae0601cf34ee54605d5eb1ceae78d8ba40141b9b9afa1db2863f06367f313727b01d6861875ad98c63b638c26ac114
SSDEEP 384:PwZcIS38N/jQmaJ8AJDZNfNoXOVSUU0XtdXqFUETRzcoXfK86sfxEZxxsIj4lBfh:2S3XhDZIO0cruNzc4ReyIsPfb9M05
TLSH
T168F2BF36EC34CC67ACE6A742F5463612BEF5912BC2D82EC495DDAF0C0A435AD431B827
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 ff3f1460cd1ddb88251a5e926f3d48454c5ba01b735ea9ad5341c77807f653c6
MD5 4ea47558d81766dc8a69cfa24558a74b
SHA1 d2bd30ebe2e1733ed6422d710b3de283167e9baa
SHA512 02185726cac4ec102fdfee75474eaa1c4a929d4a8e6c0849e5cbd7c7972651552889054bb15e386c08ccc396b738ff6e1a6ed60b7b1d7892e53497ea12e5803e
SSDEEP 768:Hrv+4UNbdh3jhDZIO0cruNzc4ReyIsPf0:Hbsb/3qtc44bsX0
TLSH
T14D03BD36F828C967ACE66685F10776537EF8511BC2C92E94C9DD2F0C464B1EE131B923
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 37KB
SHA256 34b72b3573b7f1c9fb5603cef0ca9788af8723d0462ef06f277f9aeb7de8bc71
MD5 35b870a74494076ead2a45b617e0369e
SHA1 532fadec89e2bb7029118243f724d40c70b5eb04
SHA512 d57a1c0746279072327f89a3682c26bbad3c794eae7dbc2912d4aed17becb9b171f6f6f1eeba11946daffaa9c10096fbfffb4d0807fb43c713649a7590481027
SSDEEP 768:rFQ936wgMhDZIO0crVNzc4ReyIsPfb9M05:+93ntc44bsXb+05
TLSH
T11503AE37AC64C977ACEA9B41F6463212BEF54127C2D86E94E6DDAF0C05475DD030BC26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 35KB
SHA256 872e69b1d0fcb4d32624b668097697764c747804b29f7b9d02a91e7aa20524d4
MD5 b977823583f55ca48783cd252fbfdf34
SHA1 9300424a4b4b7671c7eb3bb9f87c87fda3b19481
SHA512 9db0a2373e7f9b9b3917d9e32f4057676adfb0ce95919e6b6ddaa1a49c33b365fd83d8e33a84e4dacce94c1fe5d11ebd634023ba85fd21e74cff0ab744ceb955
SSDEEP 384:AwZcIS38N/CQmaJ8AJDZNfNoXOVSUU0XtdXqFUETRzcoXfK86sfxEZxxsIj4lBfh:dS38hDZIO0cruNzc4ReyIsPfb9M05
TLSH
T1D3F2BF36EC34CD67ACE6A742F5463612BEF5912BC2D82EC495DDAF0C0A435AD431B827
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 600d142e44d6005f0c9c0d77e2d67bb80af3109cd9d20a32628e40bc546fe817
MD5 1b5674683ca1173f0ea89f7a7dadab14
SHA1 10950fe0969dc19703fd872a5720986e6ab9c124
SHA512 ea0e7867b687b4926ae7bcf53f18a3a95e2cdf7e2a45ba78ef87ac53b38e36078bbe8ae44d9de4fc6ed8c9109432460e8bfed969bf93a593486a332532d370ab
SSDEEP 768:6rv+4UNbds3TVDZIO0cdNzc4ReyIsXXeVH1S5D:6bsbS35tc44bsnEH1Y
TLSH
T10703CE36A8788977ACF6A686B50772537EF8512BC2C81ED4C5DE6F0C464B1DD130B923
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\metadata.json
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

memory/4540-170-0x000002DD2A8A0000-0x000002DD2AAE1000-memory.dmp

Download