578be6eaf21a4725c0e4b8713430c3b1fc9900ffea4f70d1fd03077cd42dee95

Analysis

max time kernel
148s
max time network
154s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
23/07/2026, 12:20

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
thank.html
Size 4KB
Sample260723-ph3dcsck3v
SHA256 578be6eaf21a4725c0e4b8713430c3b1fc9900ffea4f70d1fd03077cd42dee95
MD5 3c2355bb96a92366a8e4944d9c250e75
SHA1 c584a884a75567c4a62bceaa72252af0a8ad013c
SHA512 81bbeeda59b2f3eeb61b172c07ecfefe5d658d040f012f905a389fed86f1bae3667513bd7e4eee2365481b6c952d0a5099f181a778f822ea04cd4c64fb75f711
SSDEEP 48:yUt+OtDwPgUU309Dus74CRpkzvmDeJKuVtHHiG9c39W5G6E3gUqOUvgM:nQmDwPgQbR2vmDeJKuVtHHiZE5EgAM
TLSH
T138A1522518F450271052829ABAA37929EEC2D507D686CA54F8EC47DF0FF6EDBCD0362C
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
5484	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134292828921850819"	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-3611646547-550105268-947503007-1000\{8B79DEFE-C7B5-4FDB-91F2-58FD89930649}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2352	msedge.exe
2352	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
5952	msedge.exe
5952	msedge.exe
5952	msedge.exe
5952	msedge.exe
5952	msedge.exe
5952	msedge.exe

Suspicious use of FindShellTrayWindow 33 IoCs

pid	Process
5952	msedge.exe
5952	msedge.exe
5952	msedge.exe
5952	msedge.exe
5952	msedge.exe
5952	msedge.exe
5952	msedge.exe
5952	msedge.exe
5952	msedge.exe
5952	msedge.exe
5952	msedge.exe
5952	msedge.exe
5952	msedge.exe
5952	msedge.exe
5952	msedge.exe
5952	msedge.exe
5952	msedge.exe
5952	msedge.exe
5952	msedge.exe
5952	msedge.exe
5952	msedge.exe
5952	msedge.exe
5952	msedge.exe
5952	msedge.exe
5952	msedge.exe
5952	msedge.exe
5952	msedge.exe
5952	msedge.exe
5952	msedge.exe
5952	msedge.exe
5952	msedge.exe
5952	msedge.exe
5952	msedge.exe

Suspicious use of SendNotifyMessage 16 IoCs

pid	Process
5952	msedge.exe
5952	msedge.exe
5952	msedge.exe
5952	msedge.exe
5952	msedge.exe
5952	msedge.exe
5952	msedge.exe
5952	msedge.exe
5952	msedge.exe
5952	msedge.exe
5952	msedge.exe
5952	msedge.exe
5952	msedge.exe
5952	msedge.exe
5952	msedge.exe
5952	msedge.exe

Suspicious use of WriteProcessMemory 35 IoCs

description	pid	Process	procid_target
PID 5952 wrote to memory of 6116	5952	msedge.exe	89
PID 5952 wrote to memory of 2648	5952	msedge.exe	90
PID 5952 wrote to memory of 5484	5952	msedge.exe	91
PID 5952 wrote to memory of 2648	5952	msedge.exe	90
PID 5952 wrote to memory of 2648	5952	msedge.exe	90
PID 5952 wrote to memory of 5080	5952	msedge.exe	94
PID 5952 wrote to memory of 5080	5952	msedge.exe	94
PID 5952 wrote to memory of 5080	5952	msedge.exe	94
PID 5952 wrote to memory of 6020	5952	msedge.exe	95
PID 5952 wrote to memory of 6020	5952	msedge.exe	95
PID 5952 wrote to memory of 6020	5952	msedge.exe	95
PID 5952 wrote to memory of 4460	5952	msedge.exe	93
PID 5952 wrote to memory of 4460	5952	msedge.exe	93
PID 5952 wrote to memory of 5916	5952	msedge.exe	96
PID 5952 wrote to memory of 5636	5952	msedge.exe	97
PID 5952 wrote to memory of 5916	5952	msedge.exe	96
PID 5952 wrote to memory of 5916	5952	msedge.exe	96
PID 5952 wrote to memory of 5636	5952	msedge.exe	97
PID 5952 wrote to memory of 5636	5952	msedge.exe	97
PID 5952 wrote to memory of 4456	5952	msedge.exe	99
PID 5952 wrote to memory of 5332	5952	msedge.exe	100
PID 5952 wrote to memory of 4456	5952	msedge.exe	99
PID 5952 wrote to memory of 5332	5952	msedge.exe	100
PID 5952 wrote to memory of 3316	5952	msedge.exe	102
PID 5952 wrote to memory of 120	5952	msedge.exe	106
PID 5952 wrote to memory of 4448	5952	msedge.exe	107
PID 5952 wrote to memory of 3980	5952	msedge.exe	108
PID 5952 wrote to memory of 3020	5952	msedge.exe	109
PID 5952 wrote to memory of 3020	5952	msedge.exe	109
PID 5952 wrote to memory of 3020	5952	msedge.exe	109
PID 5952 wrote to memory of 2784	5952	msedge.exe	110
PID 5952 wrote to memory of 2784	5952	msedge.exe	110
PID 5952 wrote to memory of 5356	5952	msedge.exe	112
PID 5952 wrote to memory of 5356	5952	msedge.exe	112
PID 5952 wrote to memory of 2352	5952	msedge.exe	113

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument C:\Users\Admin\AppData\Local\Temp\thank.html
1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:5952
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x260,0x264,0x268,0x25c,0x29c,0x7ffe2b95c188,0x7ffe2b95c194,0x7ffe2b95c1a0
  2⤵
  PID:6116
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1540,i,4331303808519556018,5512048268838243816,262144 --field-trial-handle=2216,i,10180417568835134383,3696098906516631935,262144 --variations-seed-version --mojo-platform-channel-handle=2212 /prefetch:2
  2⤵
  PID:2648
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1860,i,10003893162158229180,11017326161303968594,524288 --field-trial-handle=2216,i,10180417568835134383,3696098906516631935,262144 --variations-seed-version --mojo-platform-channel-handle=2244 /prefetch:11
  2⤵
  - System Time Discovery
  PID:5484
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2324,i,3138350771240975061,16240579043327775615,524288 --field-trial-handle=2216,i,10180417568835134383,3696098906516631935,262144 --variations-seed-version --mojo-platform-channel-handle=3044 /prefetch:13
  2⤵
  PID:4460
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3536,i,8723167436292813477,14536543764361481077,2097152 --field-trial-handle=2216,i,10180417568835134383,3696098906516631935,262144 --variations-seed-version --mojo-platform-channel-handle=3608 /prefetch:1
  2⤵
  PID:5080
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3544,i,16060104014427170058,9528740085225771054,2097152 --field-trial-handle=2216,i,10180417568835134383,3696098906516631935,262144 --variations-seed-version --mojo-platform-channel-handle=3612 /prefetch:1
  2⤵
  PID:6020
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4320,i,4946134928822955625,15027115633691479162,2097152 --field-trial-handle=2216,i,10180417568835134383,3696098906516631935,262144 --variations-seed-version --mojo-platform-channel-handle=4536 /prefetch:1
  2⤵
  PID:5916
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4344,i,8329857763956181425,17494873486760805551,2097152 --field-trial-handle=2216,i,10180417568835134383,3696098906516631935,262144 --variations-seed-version --mojo-platform-channel-handle=4600 /prefetch:9
  2⤵
  PID:5636
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5440,i,2005448844086044452,13799787377480045906,524288 --field-trial-handle=2216,i,10180417568835134383,3696098906516631935,262144 --variations-seed-version --mojo-platform-channel-handle=3740 /prefetch:14
  2⤵
  PID:4456
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5420,i,5500084065387316514,18221437856059963144,524288 --field-trial-handle=2216,i,10180417568835134383,3696098906516631935,262144 --variations-seed-version --mojo-platform-channel-handle=5496 /prefetch:14
  2⤵
  PID:5332
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5972,i,1448967864834902454,11344306273084992907,524288 --field-trial-handle=2216,i,10180417568835134383,3696098906516631935,262144 --variations-seed-version --mojo-platform-channel-handle=5992 /prefetch:14
  2⤵
  PID:1624
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5972,i,1448967864834902454,11344306273084992907,524288 --field-trial-handle=2216,i,10180417568835134383,3696098906516631935,262144 --variations-seed-version --mojo-platform-channel-handle=5992 /prefetch:14
  2⤵
  PID:3316
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3764,i,3360719076739254565,1831274560456482347,524288 --field-trial-handle=2216,i,10180417568835134383,3696098906516631935,262144 --variations-seed-version --mojo-platform-channel-handle=5972 /prefetch:14
  2⤵
  PID:120
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4660,i,9853184345807340746,10253096443671502076,524288 --field-trial-handle=2216,i,10180417568835134383,3696098906516631935,262144 --variations-seed-version --mojo-platform-channel-handle=4648 /prefetch:14
  2⤵
  PID:4448
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4556,i,1402080296945128886,10515333921081085185,524288 --field-trial-handle=2216,i,10180417568835134383,3696098906516631935,262144 --variations-seed-version --mojo-platform-channel-handle=4824 /prefetch:14
  2⤵
  PID:3980
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --always-read-main-dll --metrics-shmem-handle=1904,i,17266548772999633556,15800137883141394184,2097152 --field-trial-handle=2216,i,10180417568835134383,3696098906516631935,262144 --variations-seed-version --mojo-platform-channel-handle=2636 /prefetch:1
  2⤵
  PID:3020
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5668,i,844723167225604959,8998655967822243579,524288 --field-trial-handle=2216,i,10180417568835134383,3696098906516631935,262144 --variations-seed-version --mojo-platform-channel-handle=3824 /prefetch:14
  2⤵
  PID:2784
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=840,i,15850538905548213994,14210371435084313271,524288 --field-trial-handle=2216,i,10180417568835134383,3696098906516631935,262144 --variations-seed-version --mojo-platform-channel-handle=836 /prefetch:14
  2⤵
  PID:5356
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6248,i,12302409715366498099,1162420645535787426,262144 --field-trial-handle=2216,i,10180417568835134383,3696098906516631935,262144 --variations-seed-version --mojo-platform-channel-handle=5488 /prefetch:10
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2352

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:3272

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:3648

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 ee3af991fa1719733ca1e3ac746d5b605f4205e269bf244bd9ae780ceadb9bd8
MD5 a044f6413820c4c3fbd300ee9b379ebc
SHA1 94fc91536a25274f06d3a6e89322dec7fde7912e
SHA512 ced4374c54d7b4ea2b76afe4ca5d8841dfb55d8cb5db96de4ed49e64bd3850a817db5301787c268756641c94c0bf85eb4ee188f04fc891fa2e45ad48284985a5
TLSH
T13AD02BA433044D0CCE40203215B8A210720484209C49031A8D41B01C8C6FD4387171FB
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 22c1d58ffa7df77a7e0440ce3b2c474b1e03f30b60355bbf5dd6392fefb641fd
MD5 b9f45a900b1f64efbf90731f41c6ad44
SHA1 0c28e85e464e328fbbc07373b05113d39f83bdcc
SHA512 132313545c55ea809da0e811d6d5d324ecf5b6cfaefadb3fa4a29df5e6266dfeca7cffa4daf21754b4b37771504d3692189b5660a468784b5eaf80bf92f59ae0
TLSH
T11ED02BA033044C0CCE40203215B9A210720484204849031A8E41F02C8C6FD4387161F7
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 1KB
SHA256 83043f8edabca30784ac26f503ebc56af4be5b72a3288b048099322840301de0
MD5 3dd54702f31c5d70f470c631397663c7
SHA1 3d24f8ed2360e4074a2853bb4f5179d90f40905e
SHA512 d730cd8bff7e8a59862c66854f5fd39126e66f95c9e46b79759dd1b4b06a68db08b16d71b30b670ba32752fd141f3c90ed8a334a3caf680092388bee9f69a05e
TLSH
T134312B53C32798D6E7B2E1F735D14A5BB2778899CE0BAF50000362F08A823EC13690C8
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 2KB
SHA256 924a25bc416f649b30e0540fb17fc3eead8f7ba5d1e99c121f7fb38b77d3e4d8
MD5 46c2c04d841b93dca12647e91d5f2ffb
SHA1 616a05a6dcfcbb1460b6e1963a5180d072791bcc
SHA512 4d0b17ea4449edfa15bd343b5ce85a9387bcd6378ad7edbe38f6bad89055bdd78df40821bc2ffcf941da603e33c3c0848a77efe5a007827846e3ad127632942c
TLSH
T10C416323C36758D6D7B6A2F375D9495BB2B388B9CE1BAF60400362F44A813ED03194CC
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 3KB
SHA256 8164262adff4756eab7dc7f9b24091a75d8915598dd08d97c9f09aedd16659a1
MD5 ef80d2eedd12f06cebf398b8fe9ee14a
SHA1 a66e5279f48786747afe490d4362d0a9ab0909fb
SHA512 417df7b5bc56fe7b366c58294d3005c11421d6e450f96e8adaa8753e3ff73fe9906480e1b3fdaf307daa348094e883b09b75bb30da7934b5d0e54dba1bb595c7
TLSH
T1C471ADB7C3E4877DC81556F0AB247E2ACE1D0956432C3C1AC9E4AF1BA3E24B1D24165F
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 4KB
SHA256 374608705b79b7985ee300cf60766de90a8ec9f09e3785a9fc4655d30a648ccb
MD5 58740ec9aa79a113cc2f1274ef757473
SHA1 38573a75b6d33fc92ea6f9696cbd1a739607c50e
SHA512 a189e925775a8d78ae4c35ecd37701a9276d2d7a299c55e658573e094d463aec49d63eb995a706c15c875e639c2573eefd48f82fecf5e909755eefa5fbecb660
SSDEEP 48:YALlgZgTNWOgBRSsR1sJ1GaAsJEfoKsJBgmgCZsg8sTZMscrsxzBTQsHC7wB1soZ:D6oUOcb3aKIi0/ZgMzBbGwBLZt7eqEQ
TLSH
T1B0A17CF7C3E4866DC81556F0AB14BE2BCE1D1916432C3C2A89E4AF5BA7E3471D20164F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 c2e1c4cf39aa562838dee9c795665ee9f29d2f29a0b4f1d3e837ede9e8df842d
MD5 20f6f2cbcfe235c21fc7fc989e7167c7
SHA1 578d750a595bcb22d26781fc121d888d14ffb847
SHA512 24616b5fe208f335e83b21b7474d0d6f98624b2b8a8a349cdcf306c684187c648930b3440d9b382c84890f30853c38bb5b29ea4236d97198d749ac3c2f3c02ec
SSDEEP 192:sxRlRqbO/fwsBs+pq1zPKzoD8p4R/g6+WNIYGGkcGNIgDPJ:sxRlyO/fwsi+4j2Q/5I5Zt
TLSH
T1E432C91A6928993B9CCBE20DFB557F53E2FA5032A1D52E48A7FC870C04E76DE520741B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 960f52b00c7c1bc8bfa4aa8c1292116995ea8f282510bf965b319e070d08cc36
MD5 339e8de16bc7ae5f6ce97cae45173cca
SHA1 dcf846783a288e77f1e8f4f52f2b1e1a15d8c264
SHA512 c7bf4de140931cc0d447794a3efa094365793001f10d85440317bf9a1873bee5a31c8003ea43ff05904da5dfb13da3edd93d7b98dc6c6f7d4eb43a63023a9519
SSDEEP 192:sxRKRqbO/fwse2pq1zPKzoD8p4R/g6+WNIYGlkkcGNIgIJ:sxRKyO/fwse24j2Q/5ItZs
TLSH
T18732C81A6928993B8CCBE20DFB557F53D2FE5032A1D52E58A7FC860C04E76DE120781B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 c7f60cfd49768245e74c29c118da822f3de6f5973b49a9ee4c4187a4415a35a5
MD5 9a57240636c7c29cc09dd9a283e7ac7f
SHA1 3149705b78822deee6c7d274f0b75b34a196b1f3
SHA512 e30ea30d9762a3940a28d93f157545888f5d2b481dd635f74d50e1dd42ee9f0005f2fff4fc1b1a72aeb9939c410e1ead4936101b550193ddbf7a351f20372d71
SSDEEP 192:sxRlRqbO/fwsBs2pq1zPKzoD8p4R/g6+WNIYGlkkcGNIgDpJ:sxRlyO/fwsi24j2Q/5ItZ/
TLSH
T11032D81A6928993B8CCBE20DFB557F53D2FE5032A1D12E58A7FC860C04E76DE121741B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 23KB
SHA256 2ac98df7b870ecb10e60647d91549df4a63eca1607e42f457e374dd971572fd8
MD5 76692a77bb35b3e3d5243b7c4aad6715
SHA1 3baaedb73037db7bf89a0fb403a82040947d4e15
SHA512 0b0f45bfcdf730b59018bfd50aa9e06b11b13cbcef31f6b17b90cf59dd268064a5713224b56581a708a57ce672c6fc65c7996d0515ac7ba95a449762e82c528a
SSDEEP 384:US5Yi0hfCtgvZFfxJKhOObJ+UoAYDCx9TuqZz0VfUCh7xbog/OVDT9NHRIKrow1:UQYi0NWgv7fxJ8F1+UoAYDCx9Tuqh0V8
TLSH
T13AB2FC3B600DCB7E9F800AADAC197FDB7D9802C796589D4047FE990C02C77FA911A4DA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 9c16161490647108fb283d6358444716060b1c53772f8a67b0eb6f4c922627b0
MD5 0e54fe074250fb26b36428b0fbf08307
SHA1 55d123b63ee6adf9d8c60d0c4fffe7150f36d507
SHA512 b3f0200348fe85a77313532a1bdada9057eb8fffdcf48a6675f52544a57f2361ad50ff0f3a0f1f6e733c5e48bfbff384a04933c8af05c1b9ce456a99eeb831f0
SSDEEP 96:KRm7KmgIIOW4tVgGOK47g0OcOGlkYp8IamqwWuzjgwwK4lgSwcgwDyYdH/oNJ/9D:Cm7KmgIIJ4tWGm7g09OGlkYp8IamqXuv
TLSH
T11D910455733B1240383DAC4891B9C51B82C2B0A33459A83B7BEC55669F6AE039DFE9CD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

65369854-9dc2-40f5-9127-42707a80c08c.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\65369854-9dc2-40f5-9127-42707a80c08c.tmp
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 35KB
SHA256 349a0d28163b249002075e45d98bcc3bd4de6046a8f00baf1ab695d609607b97
MD5 c3b800e753b63343ae289d392bfc5386
SHA1 ed33320463720adbc1b576a41615867d97f7e843
SHA512 b6a5f4d17c3df99f8aac27b1d638eb2e3b0896b1174339c406e20bf72726e5b214f0ee45d0329006a836e9b59a50fe2d25b5c64591cf4ec0e396f6681465d3e9
SSDEEP 768:QAN3JOQzlYy1B6Cni7Hucys6BRvi82oP4/z6himo6Sb9Mf:QAN3/ICX3imOz6Imohb+f
TLSH
T1DEF2C035EC548E73DCE7C294B4463A536FE06223D6CC6984E5DEEF0D1687AAD4316832
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 91fb83d2e323aea03add2a21d7c02abab12e6537c6056ced95871c1555360034
MD5 25e26d2765dcd18eb9990642ef8d97cc
SHA1 19eb081d43889b124f20d8b00d45f93dcee4e8cc
SHA512 23a5ea2582d7b16e1e042e2e37a30b643ee01b341436e6342003991c58200eb18e336c9446ee5a8d980b3ab087571cc104fd6a7444105e0c525f491471c8cb80
SSDEEP 768:+krv+4UNbdS38vYzlYy1B6Cni7Hucys6BRvi82oP4/z6himo6SF:+kbsbQ3RICX3imOz6ImohF
TLSH
T1AD03BF35B8648E73DCE78288B0467A533FE4521385CC6A94D5DE6F4D128BAAE131BC73
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 35KB
SHA256 31de3ea19677fe1ad58f132128684262837b3250e961caebdd2be7288f3dac6e
MD5 16cdd8c89c54d140419492ce1e5ff597
SHA1 062c6735be94c4c5827b5d0288e1fad4c8fd47c6
SHA512 5c5e565232795c109f705af435e8cb24f09a016db4c197c4f2f5946cbe0845282729d20c9a52f76fd7e9bf5686ffb208e1cbefdc46fee55053f959b444a1534a
SSDEEP 768:+AN38OQzlYy1B6Cni7Hucys6BRvi82oP4/z6himo6Sb9Mf:+AN3eICX3imOz6Imohb+f
TLSH
T115F2C035EC648D73DCE7C298B4863A536FE06223D6CC6984E5DEEF0D1687A6D4316832
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 42KB
SHA256 bc108015bbade599377f30675f042fb4fb32b4386f23bbb1e23e84f4d16993d6
MD5 685ce6012565aa6096ddf3754a114d78
SHA1 ad01d95ebe9ecf3509d64ead19a7863f443869d9
SHA512 df2711d45b77e4215e0a9b370623f60ef0fb1ec9909abf7b18efd46960de984414ee9812d5cd6404a5c59da4d16a75255aee15e26832ce04766f065bc5b44302
SSDEEP 768:oSFQO3mwgYOLzlYy1B6Cnt7Hucys6BRvi82oP4/z6himo6Sb9Mf:opO30ICk3imOz6Imohb+f
TLSH
T121135AF298D38936DCAE8757A77D2E025EBCD123B5886584B3C99A0DCD475BFC306821
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 d9e88cb4385a20acad8d75271b413d157d145e4d57a6807d21c29904185b66f3
MD5 3417500a2c2ee78907d3d62a7d2b8ab3
SHA1 bd9afec2f5059942175c8fd6fb3bf685c2e576b1
SHA512 052cbd20e15d5fea64953ba306bda6a70e0acd6d1514d3f9fa17e9c2b4218e8933a8e308ca4ec5b869bdb76bafcbf37a60d7b3f68f7786e88a6f01199e91e157
SSDEEP 768:xGrv+4UNbdS3OLplYy1Bo7Hucys6BRvi82oP4/z6himo+H2bwn+h:xGbsbw3ODD3imOz6ImoA0w+
TLSH
T18703BF36E4548973DDE78288B4467A637FF4522385C91AC0E6DE6B0E528B99E130BC63
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RevisitationBloomfilter

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
Size 392B
SHA256 600f556a9dbdccf1c023127f647f035d5b14a8473b787a10e2d614aceff1afcf
MD5 7d2197bc47fed6b16836bc0e6e229fdb
SHA1 4071208dbb54a29a91fa5f4447c6f0aef4ae3787
SHA512 d5cad469fe77d3d1bd1082abd570586769d07d27e0f1ebbc88c7006c1885ae798659e2a1cedbca41b601d02b7fe48c3a3870b9031c4cfbcc7606af0cccc196ae
MD5 SHA1 SHA512

Submit Download

RevisitationBloomfilter~RFe5a889a.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter~RFe5a889a.TMP
Size 392B
SHA256 f41898624bd439d9d7a0809062af20c1682d682ba16d89d82f14d42238435edb
MD5 abfde75b2d4b636fbf6def000c603e86
SHA1 4803fa198a72fad7aadd671d5050fc0049865bb9
SHA512 6f6b162e553a5cac3599937c5ce597f67fe364729bae8b5394115b222b3c652a52190f6a991937d361839ee4ff5a91221ab7cda9b5f9115f13ea6e7db8fc033d
MD5 SHA1 SHA512

Submit Download

22c4ba1d-b8d8-4500-ab53-aabfe9ee865a.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\22c4ba1d-b8d8-4500-ab53-aabfe9ee865a.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download