ef52815b35b2a589f4763e23b392c9d3ac253e2d5c136b3a6aacaf580a3361f4

Analysis

max time kernel
150s
max time network
154s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
24/07/2026, 12:26

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
medical/apexcare/services/dental-implants.html
Size 44KB
Sample260724-pl8dsaej8y
SHA256 ef52815b35b2a589f4763e23b392c9d3ac253e2d5c136b3a6aacaf580a3361f4
MD5 70f99a8479bedfa1b12c1017790c6103
SHA1 a30e5ba3a117c41dc199163374ec45f8e43a2199
SHA512 bc83e4b0f72acbd982e9fa3410ece3426af0f686505e47c6679780982398792293744aef74ba8ef4e4d6a15f7d4942d3de5d5730bf3dc69607c9c56f996218be
SSDEEP 768:3OeLQ2KMvQhA1b5uXd3Rc7O0tj3HQXrOsOL3pd9bxkftrKJmmvi0I9wSkCu+8DLr:YUfb
TLSH
T1FD13741698C09023017386ED83B56A9CEBC681839F97590533FD1783AFF7D6AD99B848
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
5040	msedge.exe

Checks SCSI registry key(s) 3 TTPs 6 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	msedge.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags	msedge.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\UpperFilters	msedge.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000	msedge.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\ConfigFlags	msedge.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\UpperFilters	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134293698153987538"	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-552508041-2681165170-3229858294-1000\{6C38BCDF-82F5-4F11-A76D-BC2E77BC2F67}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
556	msedge.exe
556	msedge.exe

Suspicious behavior: LoadsDriver 1 IoCs

pid	Process
820	Process not Found

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
1680	msedge.exe
1680	msedge.exe
1680	msedge.exe
1680	msedge.exe
1680	msedge.exe
1680	msedge.exe
1680	msedge.exe

Suspicious use of FindShellTrayWindow 33 IoCs

pid	Process
1680	msedge.exe
1680	msedge.exe
1680	msedge.exe
1680	msedge.exe
1680	msedge.exe
1680	msedge.exe
1680	msedge.exe
1680	msedge.exe
1680	msedge.exe
1680	msedge.exe
1680	msedge.exe
1680	msedge.exe
1680	msedge.exe
1680	msedge.exe
1680	msedge.exe
1680	msedge.exe
1680	msedge.exe
1680	msedge.exe
1680	msedge.exe
1680	msedge.exe
1680	msedge.exe
1680	msedge.exe
1680	msedge.exe
1680	msedge.exe
1680	msedge.exe
1680	msedge.exe
1680	msedge.exe
1680	msedge.exe
1680	msedge.exe
1680	msedge.exe
1680	msedge.exe
1680	msedge.exe
1680	msedge.exe

Suspicious use of SendNotifyMessage 16 IoCs

pid	Process
1680	msedge.exe
1680	msedge.exe
1680	msedge.exe
1680	msedge.exe
1680	msedge.exe
1680	msedge.exe
1680	msedge.exe
1680	msedge.exe
1680	msedge.exe
1680	msedge.exe
1680	msedge.exe
1680	msedge.exe
1680	msedge.exe
1680	msedge.exe
1680	msedge.exe
1680	msedge.exe

Suspicious use of WriteProcessMemory 36 IoCs

description	pid	Process	procid_target
PID 1680 wrote to memory of 436	1680	msedge.exe	89
PID 1680 wrote to memory of 1640	1680	msedge.exe	90
PID 1680 wrote to memory of 5040	1680	msedge.exe	92
PID 1680 wrote to memory of 1640	1680	msedge.exe	90
PID 1680 wrote to memory of 1640	1680	msedge.exe	90
PID 1680 wrote to memory of 5240	1680	msedge.exe	93
PID 1680 wrote to memory of 2344	1680	msedge.exe	94
PID 1680 wrote to memory of 5240	1680	msedge.exe	93
PID 1680 wrote to memory of 2344	1680	msedge.exe	94
PID 1680 wrote to memory of 2344	1680	msedge.exe	94
PID 1680 wrote to memory of 552	1680	msedge.exe	95
PID 1680 wrote to memory of 552	1680	msedge.exe	95
PID 1680 wrote to memory of 552	1680	msedge.exe	95
PID 1680 wrote to memory of 472	1680	msedge.exe	96
PID 1680 wrote to memory of 472	1680	msedge.exe	96
PID 1680 wrote to memory of 472	1680	msedge.exe	96
PID 1680 wrote to memory of 4320	1680	msedge.exe	97
PID 1680 wrote to memory of 4320	1680	msedge.exe	97
PID 1680 wrote to memory of 4320	1680	msedge.exe	97
PID 1680 wrote to memory of 4812	1680	msedge.exe	99
PID 1680 wrote to memory of 4812	1680	msedge.exe	99
PID 1680 wrote to memory of 4812	1680	msedge.exe	99
PID 1680 wrote to memory of 2612	1680	msedge.exe	100
PID 1680 wrote to memory of 2612	1680	msedge.exe	100
PID 1680 wrote to memory of 2612	1680	msedge.exe	100
PID 1680 wrote to memory of 2892	1680	msedge.exe	101
PID 1680 wrote to memory of 2892	1680	msedge.exe	101
PID 1680 wrote to memory of 3988	1680	msedge.exe	102
PID 1680 wrote to memory of 3988	1680	msedge.exe	102
PID 1680 wrote to memory of 4300	1680	msedge.exe	104
PID 1680 wrote to memory of 2740	1680	msedge.exe	108
PID 1680 wrote to memory of 4112	1680	msedge.exe	109
PID 1680 wrote to memory of 1788	1680	msedge.exe	110
PID 1680 wrote to memory of 3592	1680	msedge.exe	111
PID 1680 wrote to memory of 3592	1680	msedge.exe	111
PID 1680 wrote to memory of 556	1680	msedge.exe	113

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument C:\Users\Admin\AppData\Local\Temp\medical\apexcare\services\dental-implants.html
1⤵
- Checks SCSI registry key(s)
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1680
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x260,0x264,0x268,0x25c,0x2c0,0x7ff84538c188,0x7ff84538c194,0x7ff84538c1a0
  2⤵
  PID:436
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1528,i,17081561729374682182,6544850074188523308,262144 --field-trial-handle=2168,i,3166421513682981384,5467452331485953684,262144 --variations-seed-version --mojo-platform-channel-handle=2088 /prefetch:2
  2⤵
  PID:1640
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1848,i,4183065007566286781,13979811419906758085,524288 --field-trial-handle=2168,i,3166421513682981384,5467452331485953684,262144 --variations-seed-version --mojo-platform-channel-handle=2212 /prefetch:11
  2⤵
  - System Time Discovery
  PID:5040
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2480,i,11829692891620175737,6132162847342025434,524288 --field-trial-handle=2168,i,3166421513682981384,5467452331485953684,262144 --variations-seed-version --mojo-platform-channel-handle=3528 /prefetch:13
  2⤵
  PID:5240
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3352,i,1359778283904177943,8746092464835012269,2097152 --field-trial-handle=2168,i,3166421513682981384,5467452331485953684,262144 --variations-seed-version --mojo-platform-channel-handle=3548 /prefetch:1
  2⤵
  PID:2344
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3372,i,2022553163845102429,8983208319313055406,2097152 --field-trial-handle=2168,i,3166421513682981384,5467452331485953684,262144 --variations-seed-version --mojo-platform-channel-handle=3552 /prefetch:1
  2⤵
  PID:552
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4256,i,6527753248609232611,17035362669149078342,2097152 --field-trial-handle=2168,i,3166421513682981384,5467452331485953684,262144 --variations-seed-version --mojo-platform-channel-handle=4532 /prefetch:9
  2⤵
  PID:472
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4220,i,6078006321169541340,18065376032068773026,2097152 --field-trial-handle=2168,i,3166421513682981384,5467452331485953684,262144 --variations-seed-version --mojo-platform-channel-handle=4528 /prefetch:1
  2⤵
  PID:4320
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=5380,i,3191699251124574723,5532436463168161041,2097152 --field-trial-handle=2168,i,3166421513682981384,5467452331485953684,262144 --variations-seed-version --mojo-platform-channel-handle=3748 /prefetch:1
  2⤵
  PID:4812
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --always-read-main-dll --metrics-shmem-handle=3784,i,11146788853949811240,1429496352881498291,2097152 --field-trial-handle=2168,i,3166421513682981384,5467452331485953684,262144 --variations-seed-version --mojo-platform-channel-handle=5324 /prefetch:1
  2⤵
  PID:2612
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5676,i,2790403935523652572,393774240956622075,524288 --field-trial-handle=2168,i,3166421513682981384,5467452331485953684,262144 --variations-seed-version --mojo-platform-channel-handle=5688 /prefetch:14
  2⤵
  PID:2892
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5684,i,18411648767951288157,8465467865548669825,524288 --field-trial-handle=2168,i,3166421513682981384,5467452331485953684,262144 --variations-seed-version --mojo-platform-channel-handle=5804 /prefetch:14
  2⤵
  PID:3988
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6484,i,5124639159409709069,17869300963858242331,524288 --field-trial-handle=2168,i,3166421513682981384,5467452331485953684,262144 --variations-seed-version --mojo-platform-channel-handle=6488 /prefetch:14
  2⤵
  PID:4100
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6484,i,5124639159409709069,17869300963858242331,524288 --field-trial-handle=2168,i,3166421513682981384,5467452331485953684,262144 --variations-seed-version --mojo-platform-channel-handle=6488 /prefetch:14
  2⤵
  PID:4300
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6876,i,12478818183637073169,5312747806056786008,524288 --field-trial-handle=2168,i,3166421513682981384,5467452331485953684,262144 --variations-seed-version --mojo-platform-channel-handle=5168 /prefetch:14
  2⤵
  PID:2740
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6892,i,15261606904154421504,9395613457220386533,524288 --field-trial-handle=2168,i,3166421513682981384,5467452331485953684,262144 --variations-seed-version --mojo-platform-channel-handle=6872 /prefetch:14
  2⤵
  PID:4112
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6852,i,9724247043164894763,7317567551217442893,524288 --field-trial-handle=2168,i,3166421513682981384,5467452331485953684,262144 --variations-seed-version --mojo-platform-channel-handle=5176 /prefetch:14
  2⤵
  PID:1788
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6060,i,5254885151293706399,12045190035353048286,524288 --field-trial-handle=2168,i,3166421513682981384,5467452331485953684,262144 --variations-seed-version --mojo-platform-channel-handle=5528 /prefetch:14
  2⤵
  PID:3592
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6852,i,17412020727915542021,9531062419264887336,262144 --field-trial-handle=2168,i,3166421513682981384,5467452331485953684,262144 --variations-seed-version --mojo-platform-channel-handle=6884 /prefetch:10
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:556

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:5852

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:6120

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 f8dff5315a0bd3856381f405c1a16257337fd6ff2d8043dd8bea22404cd35129
MD5 5e53a2cd139f0cce4f8ceab3e015f7da
SHA1 1bd884dbaaa352a724c53bfb8f4bfad2623c93f5
SHA512 27cc4cb62f9aa4af6b521efd824b001f3b689bae2ffe57263da18e2bb22d0b13ba656141d7e6ea1d1c202d5f461a44243a00d604f78bd5b04fe6b8512e260ac1
TLSH
T178D02B1463108D04D441F13214D13311B1110833A80C96440050E1284CB634206738DD
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 1f3bc43c50f7d0fa02f98500baf5d78052a5560603459a9325b17de989d121f4
MD5 46a6445fd2c83830bb8c6e03f85bafc0
SHA1 46b07e35efbd47692fdc81ef0e82e2964da2831b
SHA512 800f82b05756fd6fab3fe29924147f0b86afeec21da661e646b431c6ca03903eb45bb09803f5cdaf3d2d1bb16f95d0f2e53a1f9ddde57505b0f3e1580c384ed1
TLSH
T188D02B1063208C04D441F13214D23311B1010833540C96440150E1384CB634206728CD
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 2KB
SHA256 e5f8ba7a070ef975e1ef0d22a65918e05bdf0381c6130ffbc6a8dfe12ff923e1
MD5 cb54c9a5cfa24b1a86d007fd9aa38274
SHA1 f44f368efc81052af0a9f9b4bfec1e915e9764b0
SHA512 02e54d24953bd91c092e41d7024696c9f4f88c6edc077889a307926be7ef40c20ef1b1b8358ca2cde29dc97ddb21055c2845290ad63571a1138b9cbdc2d14a2b
TLSH
T1AC419382532417D1D7A14EB261E1B65832FCD4BD8207AEC9BA002D7CAF05F289AD1463
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe595692.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe595692.TMP
Size 2KB
SHA256 a78d78b5520d4e33fc82fd80e95112b5eb3a85804818293c4faffe1ef6c2f0ec
MD5 572edd47da6f249f4ade865f278484fe
SHA1 4fa0cd2498ef833750993fd6c83554a6c1471466
SHA512 75d0e3172abbad928cfdb9f772ad10fe45f3951d5c117b22064928a1e743fcb43a724071e6026ad84f8b9a7d6981e22b4640107c3a8ffc2f01850e9e71310fa0
TLSH
T19341A482532417D1D7A14EB365E1B65832FCD0BD8207AECABA002D7CAF09F389BD1463
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 4KB
SHA256 10c1df3b7992401c5bf3690d122709718750061b65a5cca17f76f82f4feb6768
MD5 cfaa2d971b49b33c6553dba81e788072
SHA1 da668c0d4fc499b9a10a87331bb82e275a4ad7cf
SHA512 efc60854ca52a010cbb3197985272dfd52bf6bb45a81de97fc228f0551646cfe77232946a468621fc9440b9f324c18abeadf81798c7b50f2597fb7f4db37a001
SSDEEP 48:YALlg2N/OgJPPgQhKsJzaAsJ31foKsJrfgmgCZsJ3fjhhnONzsA9zsRzBO8s78sk:DZxOu7Fa91WiNjhqqzBOXeeZyGw5t
TLSH
T160919DF7C7E8876E881156F0AB257E2ADE1D061A422C3C5689F4AF0F63F2471D10169F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 4f6dea848251ea2f44641722ec03e3ca76431b67bebabd239086a4f28fc46b3a
MD5 30e9d2286c8a4b92c123952b199d58bc
SHA1 30c89c6e32191bf7d4a607dc69ea802681d41b2f
SHA512 7c316ed1cbbc697332fe2342062f1bc964f9ccdf1825e7b94771ad1bc6debf04dba516c502953177feb7a4dab182069303135f2cf8c9744bd16f877e5cae1e01
SSDEEP 192:sxRQRybt/f4sEhAfDde5lSFzoD8p4r/g6+WNIYCyuORG2vIgDpJ:sxRQSt/f4sEKfc5liK/5IQBP/
TLSH
T14F32B6166A28993B8CCBD21DFB55BF53D6F95033A1902E48B7FC960C04E76DD620740B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 5b692911d641f538254614a7415c93f181f8f9e7a8d85517f4423fa28d6cfac1
MD5 345e86a59f2fe3ad475dcb8993c1a9a8
SHA1 41ebb5e303a1ac78fe66df8919f06e81a06997e1
SHA512 2af9d2b3339565aafd28179ba011142a63f41f63ca935e51d86459080e97297efc35ea43f25d3ba9f0322ae6b753b572829fb205063eadf38569d7a864db3f4c
SSDEEP 192:sxRQRybt/f4sEhAiDde5lSFzoD8p4r/g6+WNIYChuORG2vIgDPJ:sxRQSt/f4sEKic5liK/5I9BPt
TLSH
T1ED42A5166A28993B9CCBE21DFB55BF53D6F95033A1942E48B7FC860C04E7ADD620740B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 23KB
SHA256 32597345071fe7d63b6d96148eef654cf7a09782a4f153df2d52dd88d5ff87a1
MD5 66fcea5e7de00cc31e67244dafe51484
SHA1 13a772f86af7d536b524ee2cc7a82bf08875efa5
SHA512 3e3c9fe394f75cc00bdee7390d02551b3ffee55f1953fd066971cc93e9be00175c5a7ae56d939c5339135656187b52e60bc8d69a441765d8cbfad5ca4f260725
SSDEEP 384:jjm+vhKfCtgQCFfk+KhOObJ+UoAYDCx9TuqZz0VfUCh7xbog/OVmC9qyRvoroZSy:jC+vhQWgQ+fk+8F1+UoAYDCx9Tuqh0Vs
TLSH
T152B2EB2B600DCB7F4F800AADAC197FD76D9802CB97589D5047FED94C02C77EA92194DA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 ece126b641de1edea0bcca1f675afba41c5f61ec4f7b57d6ebc00be56ee55469
MD5 5f1d2b5bd9845fed7e98522bc5cc2be5
SHA1 0d5fd3db0b69482b64767b28403390013515c3b7
SHA512 e6b29c455010586494ed3d4865b3d7811de3b59e0bc0220b505588877ef2a40acb36361063b4efe3fb705db2504f02ea5268626d24027f054f1c86894867f29f
SSDEEP 96:KRbEBVj5J1WdSIg91K4EgT1c7j6dJOHyX+SkE0SWcJhgCSK4Xg4ScCqRwSbHYp88:CbEBVj5JAdSp9/EgTK7j6dJOHyX+SkEl
TLSH
T1E1913300313B02C0383EB55CC1B89C6E86C174727516E56B3FA946AA0F67E47AEFD9C9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

.usage

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\WebStorage\2\FileSystem\t\.usage
Size 24B
SHA256 fac0a85e4f5907c8036b0052214b777ddbacea9420e5903526272dc76bd4c7b6
MD5 e1edf83f1dbe0a1640e5800ef2f44b90
SHA1 58e8f31a1282e84a05c6960d6ab461d6ccef42cc
SHA512 151b19bcb34d72c304d02f2830f577036c5d2156499cb998643a87a3010544e5a4c236f8458786ea4b3416aaa4fd1ea96fc3bfe1ab0c5baebeac29e5427ca417
MD5 SHA1 SHA512

Submit Download

00000000

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\WebStorage\2\FileSystem\t\00\00000000
Size 1B
SHA256 6e340b9cffb37a989ca544e6bb780a2c78901d3fb33738768511a30617afa01d
MD5 93b885adfe0da089cdf634904fd59f71
SHA1 5ba93c9db0cff93f52b521d7420e43f6eda2784f
SHA512 b8244d028981d693af7b456af8efa4cad63d282e19ff14942c246e50d9351d22704a802a71c3580b6370de4ceb293c324a8423342557d4e5c38438f0e36910ee
MD5 SHA1 SHA512

Submit Download

c922d8da-df3a-456b-8e09-2b4818e3bc8e.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\c922d8da-df3a-456b-8e09-2b4818e3bc8e.tmp
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ef05b971-b775-4f37-ab50-9c31f2a91353.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\ef05b971-b775-4f37-ab50-9c31f2a91353.tmp
Size 11KB
SHA256 797bf55baaf46da0af1e1c6c57621e7b98af92ec03aae91ca72f1838b2555a59
MD5 df466932d2c9ff9f9458e41157e32c31
SHA1 116072b46f8c737e5282f5d620763e6d60e50dd6
SHA512 7d89cef218b2031df675ea95118956a73cb24372c617946212ec0d1916237581e5a71ebc203b1de108270cf69978380a7de694948a17b55853072298903d8be5
SSDEEP 192:sxRbRybt/f4sqAfDde5lSFzoD8p4r/g6+WNIYCyuORG2vIgIJ:sxRbSt/f4s7fc5liK/5IQBPs
TLSH
T18432A6166A28993B8CCBE21DFB55BF53D6F95033A1906E58F7FC860C04E6ADD620740B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 0a32705786a00dd284722ad683fa25e9543a98ec48e9d17a2e3deea6ec3ef1e4
MD5 b3eea16f8c48acf9ab26f33c8917b342
SHA1 a5ce7e10607348d3f0f1f4d762b8a8bff40615f9
SHA512 ac3f6bc7aa84fc2fdd800c58bb393a600ddfaa0ef705c186c4853453a5b6bc3868b9b278bda2dfabc2262d071214fcbb71e20b66766a7718dceed4d7772bcbe1
SSDEEP 768:Qrv+4UNbdk3mVP4EKp8+p3bd66j+4BRv86aLIWJ4:Qbsb23C08+p3Z6n4yn4
TLSH
T16D03BE73E868D9338CF6C684B2467A437FF8519396C01AA4D8DD6B4D419B1AE630F827
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 41KB
SHA256 39107dd45460a5b851ec168499e52293de2662ec7ef6747025882a519595409e
MD5 e997f6eafa261647fb982295562ab974
SHA1 eebbe1fb2ef8a54cf816c4db8058a76f3d35a2ad
SHA512 2280994fb2499988a4bc9513bf183e8a91484c0075a931c4a3f1e251eb15a247050294787a1cb23a91457c3cf91687c3b2950cc36c5ad7f418cde7a4c61c4e53
SSDEEP 768:irv+4UNbdO396P4Dp8+p3bd66j+4BRv86aLIWJb9ME:ibsbM3r8+p3Z6n4ynb+E
TLSH
T16813BF33F868DA338CF6C654B2867A437FF852A386C41AD4D4DD6B4D459B0AD630B827
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 b5c96bbaa24ed4e3b23c1eb805bba1228e2b44a33a3b9801e0bbb554e70d9ad9
MD5 a8ddef986baba0bce32cc8691c2bd72b
SHA1 e6c36b6f79aeb31897ff2cfe72b0feaaaf6e6e59
SHA512 0f87d744f4ef236a1704bbe764c8b418cb10da2f4f015b487c62431a36114b99f5cf10647546274ca5a2fc8ef9231486c83e072cc748c257a065bc512013ef66
SSDEEP 768:Irv+4UNbdD3gcONp8+p3bd66j+4BRv86aLIi02bwCl1:Ibsbp3mL8+p3Z6n4ye0ww
TLSH
T14C03BE73F9A899339CF6C644B2467B437FF851A396C10AC4D4DD2B4E419A1AE630BC27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 41KB
SHA256 8331636f8e040e7019bd7d64f96ebc635a3e9b5037e7979e610b85c898ed821d
MD5 66d1034169c0a5f5f5ae5e9a0d6c9b15
SHA1 b30b77f6650ed0a1ee6f81b1537a4417f9d3e3a2
SHA512 8027578e0527fff7026fe506511f1aeda9475191e4ea7c52d7aff1e68c0157802cf7dd14057083178b5bf0a4838e3d1ced93844632e0c2c1b71bc0b8aeaf0cb7
SSDEEP 768:lrv+4UNbdk396P4ELp8+p3bd66j+4BRv86aLIWJb9ME:lbsb23Gt8+p3Z6n4ynb+E
TLSH
T16013BE33F868DA338CF2C644B1863A437FF852A396C41AD4D8DD6B4D459B0AD630B827
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

b0139260-d466-42d4-8fc6-37e6ba10b4aa.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\b0139260-d466-42d4-8fc6-37e6ba10b4aa.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download