hxxps://86541[.]s3[.]amazonaws[.]com/hlfb1apu2bb4d4tadw46n5dkhir6byd3bgtrds_0z[.]html

Analysis

user interaction
yes
max time kernel
149s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
27/07/2026, 10:39

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://86541.s3.amazonaws.com/hlfb1apu2bb4d4tadw46n5dkhir6byd3bgtrds_0z.html
Sample260727-mp2paszgra

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
2200	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134296223610558355"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-204488895-2999877624-296153668-1000\{C1504BF5-05B7-4DA2-A6F8-255E3F800224}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
388	msedge.exe
388	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 8 IoCs

pid	Process
4332	msedge.exe
4332	msedge.exe
4332	msedge.exe
4332	msedge.exe
4332	msedge.exe
4332	msedge.exe
4332	msedge.exe
4332	msedge.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
4332	msedge.exe
4332	msedge.exe
4332	msedge.exe
4332	msedge.exe
4332	msedge.exe
4332	msedge.exe
4332	msedge.exe
4332	msedge.exe
4332	msedge.exe
4332	msedge.exe
4332	msedge.exe
4332	msedge.exe
4332	msedge.exe
4332	msedge.exe
4332	msedge.exe
4332	msedge.exe
4332	msedge.exe
4332	msedge.exe
4332	msedge.exe
4332	msedge.exe
4332	msedge.exe
4332	msedge.exe
4332	msedge.exe
4332	msedge.exe
4332	msedge.exe
4332	msedge.exe
4332	msedge.exe
4332	msedge.exe
4332	msedge.exe
4332	msedge.exe
4332	msedge.exe
4332	msedge.exe
4332	msedge.exe
4332	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
4332	msedge.exe
4332	msedge.exe
4332	msedge.exe
4332	msedge.exe
4332	msedge.exe
4332	msedge.exe
4332	msedge.exe
4332	msedge.exe
4332	msedge.exe
4332	msedge.exe
4332	msedge.exe
4332	msedge.exe
4332	msedge.exe
4332	msedge.exe
4332	msedge.exe
4332	msedge.exe
4332	msedge.exe
4332	msedge.exe
4332	msedge.exe
4332	msedge.exe
4332	msedge.exe
4332	msedge.exe
4332	msedge.exe
4332	msedge.exe
4332	msedge.exe
4332	msedge.exe
4332	msedge.exe
4332	msedge.exe
4332	msedge.exe
4332	msedge.exe
4332	msedge.exe
4332	msedge.exe

Suspicious use of WriteProcessMemory 39 IoCs

description	pid	Process	procid_target
PID 4332 wrote to memory of 1832	4332	msedge.exe	86
PID 4332 wrote to memory of 2200	4332	msedge.exe	87
PID 4332 wrote to memory of 2516	4332	msedge.exe	88
PID 4332 wrote to memory of 2516	4332	msedge.exe	88
PID 4332 wrote to memory of 2516	4332	msedge.exe	88
PID 4332 wrote to memory of 4968	4332	msedge.exe	90
PID 4332 wrote to memory of 4968	4332	msedge.exe	90
PID 4332 wrote to memory of 2256	4332	msedge.exe	91
PID 4332 wrote to memory of 2256	4332	msedge.exe	91
PID 4332 wrote to memory of 2256	4332	msedge.exe	91
PID 4332 wrote to memory of 1216	4332	msedge.exe	92
PID 4332 wrote to memory of 1216	4332	msedge.exe	92
PID 4332 wrote to memory of 1216	4332	msedge.exe	92
PID 4332 wrote to memory of 3340	4332	msedge.exe	93
PID 4332 wrote to memory of 3340	4332	msedge.exe	93
PID 4332 wrote to memory of 3340	4332	msedge.exe	93
PID 4332 wrote to memory of 3784	4332	msedge.exe	94
PID 4332 wrote to memory of 3784	4332	msedge.exe	94
PID 4332 wrote to memory of 3784	4332	msedge.exe	94
PID 4332 wrote to memory of 2820	4332	msedge.exe	97
PID 4332 wrote to memory of 2820	4332	msedge.exe	97
PID 4332 wrote to memory of 2820	4332	msedge.exe	97
PID 4332 wrote to memory of 312	4332	msedge.exe	99
PID 4332 wrote to memory of 312	4332	msedge.exe	99
PID 4332 wrote to memory of 312	4332	msedge.exe	99
PID 4332 wrote to memory of 1360	4332	msedge.exe	100
PID 4332 wrote to memory of 1360	4332	msedge.exe	100
PID 4332 wrote to memory of 3956	4332	msedge.exe	101
PID 4332 wrote to memory of 3956	4332	msedge.exe	101
PID 4332 wrote to memory of 2464	4332	msedge.exe	103
PID 4332 wrote to memory of 2116	4332	msedge.exe	106
PID 4332 wrote to memory of 2116	4332	msedge.exe	106
PID 4332 wrote to memory of 2116	4332	msedge.exe	106
PID 4332 wrote to memory of 2528	4332	msedge.exe	117
PID 4332 wrote to memory of 716	4332	msedge.exe	118
PID 4332 wrote to memory of 3148	4332	msedge.exe	119
PID 4332 wrote to memory of 2976	4332	msedge.exe	121
PID 4332 wrote to memory of 2976	4332	msedge.exe	121
PID 4332 wrote to memory of 388	4332	msedge.exe	122

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://86541.s3.amazonaws.com/hlfb1apu2bb4d4tadw46n5dkhir6byd3bgtrds_0z.html
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4332
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x248,0x7ff9095ac188,0x7ff9095ac194,0x7ff9095ac1a0
  2⤵
  PID:1832
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1884,i,11898988807006385826,9009284092272116438,524288 --field-trial-handle=2164,i,7914797210350506662,10791584479221447155,262144 --variations-seed-version --mojo-platform-channel-handle=2196 /prefetch:3
  2⤵
  - System Time Discovery
  PID:2200
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1624,i,7519813148950164365,16769667207030865599,262144 --field-trial-handle=2164,i,7914797210350506662,10791584479221447155,262144 --variations-seed-version --mojo-platform-channel-handle=2160 /prefetch:2
  2⤵
  PID:2516
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2416,i,17259977945031346838,545620136562453727,524288 --field-trial-handle=2164,i,7914797210350506662,10791584479221447155,262144 --variations-seed-version --mojo-platform-channel-handle=2772 /prefetch:8
  2⤵
  PID:4968
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3420,i,2684293500126110520,14608452418875819168,2097152 --field-trial-handle=2164,i,7914797210350506662,10791584479221447155,262144 --variations-seed-version --mojo-platform-channel-handle=3496 /prefetch:1
  2⤵
  PID:2256
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3424,i,14607446602270874546,1063088099685440291,2097152 --field-trial-handle=2164,i,7914797210350506662,10791584479221447155,262144 --variations-seed-version --mojo-platform-channel-handle=3500 /prefetch:1
  2⤵
  PID:1216
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4152,i,13014908356470702112,2093678886059710554,2097152 --field-trial-handle=2164,i,7914797210350506662,10791584479221447155,262144 --variations-seed-version --mojo-platform-channel-handle=4200 /prefetch:1
  2⤵
  PID:3340
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4180,i,4368240981805875834,3550200908914908107,2097152 --field-trial-handle=2164,i,7914797210350506662,10791584479221447155,262144 --variations-seed-version --mojo-platform-channel-handle=4204 /prefetch:2
  2⤵
  PID:3784
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=5028,i,12603514745031614722,12499046499496157348,2097152 --field-trial-handle=2164,i,7914797210350506662,10791584479221447155,262144 --variations-seed-version --mojo-platform-channel-handle=4940 /prefetch:1
  2⤵
  PID:2820
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --always-read-main-dll --metrics-shmem-handle=4860,i,14521392878957388046,5219772136944532349,2097152 --field-trial-handle=2164,i,7914797210350506662,10791584479221447155,262144 --variations-seed-version --mojo-platform-channel-handle=4688 /prefetch:1
  2⤵
  PID:312
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3540,i,10937223319832481148,7523566480544525758,524288 --field-trial-handle=2164,i,7914797210350506662,10791584479221447155,262144 --variations-seed-version --mojo-platform-channel-handle=3444 /prefetch:8
  2⤵
  PID:1360
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3364,i,17616032296263526695,15057695077494276273,524288 --field-trial-handle=2164,i,7914797210350506662,10791584479221447155,262144 --variations-seed-version --mojo-platform-channel-handle=3860 /prefetch:8
  2⤵
  PID:3956
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6052,i,4851450281129772363,8162831530681969857,524288 --field-trial-handle=2164,i,7914797210350506662,10791584479221447155,262144 --variations-seed-version --mojo-platform-channel-handle=6072 /prefetch:8
  2⤵
  PID:1508
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6052,i,4851450281129772363,8162831530681969857,524288 --field-trial-handle=2164,i,7914797210350506662,10791584479221447155,262144 --variations-seed-version --mojo-platform-channel-handle=6072 /prefetch:8
  2⤵
  PID:2464
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --always-read-main-dll --metrics-shmem-handle=5400,i,1221039030818938815,18354501854794654816,2097152 --field-trial-handle=2164,i,7914797210350506662,10791584479221447155,262144 --variations-seed-version --mojo-platform-channel-handle=6456 /prefetch:1
  2⤵
  PID:2116
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4260,i,9190099196299886237,1877067022600233267,524288 --field-trial-handle=2164,i,7914797210350506662,10791584479221447155,262144 --variations-seed-version --mojo-platform-channel-handle=4160 /prefetch:8
  2⤵
  PID:2528
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4252,i,14268593997395109184,6947842884687850672,524288 --field-trial-handle=2164,i,7914797210350506662,10791584479221447155,262144 --variations-seed-version --mojo-platform-channel-handle=4744 /prefetch:8
  2⤵
  PID:716
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4692,i,6673068840175988655,12221279659980778887,524288 --field-trial-handle=2164,i,7914797210350506662,10791584479221447155,262144 --variations-seed-version --mojo-platform-channel-handle=4648 /prefetch:8
  2⤵
  PID:3148
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5536,i,8421372032020553902,10749088005463725512,524288 --field-trial-handle=2164,i,7914797210350506662,10791584479221447155,262144 --variations-seed-version --mojo-platform-channel-handle=5548 /prefetch:8
  2⤵
  PID:2976
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6248,i,7302150950428689381,9078495439258180640,262144 --field-trial-handle=2164,i,7914797210350506662,10791584479221447155,262144 --variations-seed-version --mojo-platform-channel-handle=6308 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:388

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:1436

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 ab98da7535c8de464335204ae97fd672936e639269325c3a388b3039d8396b83
MD5 1656a3560c7aeae221756f3891b89fd3
SHA1 e48441fe2b843ba3bd0bb7799c07b22a27db8eb7
SHA512 c06d7152d11e33601716d4c5c33c7373ac4e0c16571e80ac4a8ffb9cabb52fae51d4fe8d808fc75be943287b55a320e90a186d71a5f06e9db006f6ab89266400
TLSH
T1CFD09B307B597042D3074031E8074790169E84B5249B86066554410D7D5A485E3DF547
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 ec6419a915c6f94199df67c6cf1d67bc666c22ef160c8377d6792913a6518679
MD5 a8d0099e5966b86c13c6997282a63770
SHA1 df541b93a0caebe364906ec90c768bb625495f4c
SHA512 a2093c42c3f547b910f560ee7a58cb187cef96045e8e335276c7bde87fdc5e9894b670421e94170d0878e86a2bea8125d914e11181882004f966732f9670a693
TLSH
T135D09B303B597442D7074031E8064790169E84B5249BC7076554410D7D5B4C5E3DF547
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 cb8d49b2d1204998da2640793e477787ced5a2674d15367004049e68e58add8c
MD5 c0d85b6750a6f0d2bac917ad95ed5378
SHA1 481f534a877403bc83a01948ab425636e6c03931
SHA512 80504931caca90c0bd682417800fd9566d330dae059d2a9e04cceb8dae92ff28da8be36231c1268e27f98c78377d6e96c0c31f958894eff629ae7657595f420d
TLSH
T182716E3601A7CCADE72D01706CC082F334718EE9F9471E9B81BC2E741A17B63B66B588
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe58d1a3.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe58d1a3.TMP
Size 3KB
SHA256 32c655e56518d994651b597a3af65b3e41376700c3fe8b49a427fee2dc1d9e0a
MD5 825991f50fff7c96b42fd5bd3cd94fd4
SHA1 bad8b1849e8021ef377c636cffd6cc68169f9fce
SHA512 7968094aa8c0f84801b203f23e2a7f11580668d7e0d66ffcbf6d28c42ce235e7a81971257dd0ca7efba503c203d72a76a3343f610d790eebd830c8f39c179424
TLSH
T146714D360087DCADE71D00706CD141F734718DE9FD475E9B91BC2E741A16B63B22B588
MD5 SHA1 SHA512 TLSH

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

0f9017c9-9481-4679-9eee-0760c0dd6105.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\0f9017c9-9481-4679-9eee-0760c0dd6105.tmp
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 3KB
SHA256 5296ada466bb2412268d8f0a473de66361899f6d9837cad23a8ffe35aaf10bdd
MD5 f04de2233935c4a5c5be461b0fa1f8f1
SHA1 696605cf2337e784e8aa321f7903ea18d3ca1caa
SHA512 4376cf58b11d965398ba9990608b22e57cf69acf2f430a6bdb9ca6d6dfb490204d7d050a88258e0b242d322152c57d7571e4f7f1674f2d363f68aab0d7aec57f
TLSH
T1FB71BCF7C3D8822DC94156F4AB15AF1FCE2E0A18431C3D2AC5D8AF6B93E2471E11665E
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 10KB
SHA256 d1e95a49008def9776f00857ab234e1ebe04551ca893c92e29693999ad21d4ab
MD5 7f622c1c6d05c3455da51eab3c1bf1be
SHA1 0e6c987749e29ca5cd9ce3f755220c9fc4ad738c
SHA512 7a47408d03a5d2b9fcf45069c7648fdb46d9ca145b5beb64c9b47d42de7c9e8a1741b76cc3d295fea67334d0c8a49e138267093e555692c9cda9ee9f1da17ddb
SSDEEP 192:sxZWRxLko/fCsouzxIdpqXqtPHW6+WNfnJm9/YzWHEVIgrJ:sxZWko/fCsouezHbC/o9
TLSH
T15832C8536A34597B8CDBD319BA15BB13E6F96072A1D50E44BAFCD60C04EABDD230780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 4f6745465ba66d6ab42816ad4de6f0111dd2031c91f7ad850f7f7c9e14fdf757
MD5 74929e14544a97dc16e79faa5179ed13
SHA1 c0b3066012cf975333148a4189ca37d93370375d
SHA512 1676fb55d8f74153da6935840d5ae90e1e3d0ebe0058e0c4970d3492595d922b3ec21ac3a87f485038ce6b69ea2c146328007785628d910e2a082428f702f04f
SSDEEP 192:sxZWRxLko/fCsjK6xIdpqXqtPHW6+WNfnJm9/YzRNEVIg5/J:sxZWko/fCsjKHzHbC/TP
TLSH
T14732C757A934597B8CDAD219BA14BF13E6F55072A1D10E44A6FCCB0C05EABDD230780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 d4e35486be8bb78cd1e286d9f551ae2d79ce686a2475156e2a2a418201fea50c
MD5 9827a238c86bba2ab9368e4b5abb519c
SHA1 2fd191c1fb57dbde5c9b0e1dafd164b01dbb1168
SHA512 6f5fb99ab83ef4dd25bc7d8ec41659d2ff0f63c0819ea543d9333fb31793dd3d66526f7632f6d21c98547b73d14d9bb332eebc5432dc5e31e8ea658d8d46c019
SSDEEP 192:sxZWRxLko/fCsju6xIdpqXqtPHW6+WNfnJm9/YzWHEVIg5VJ:sxZWko/fCsjuHzHbC/o5
TLSH
T1E032D757AA34597B8CDAD319BA14BB13E6F95072A1D51E44AAFCC60C04EABDD230780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 27KB
SHA256 df3da4bbb41e1bb794d7f66884881c0f6b951ff68b208a806fc2fc3f5f83fda7
MD5 c49f789a5ab107b8b15ef8d4ddba4353
SHA1 f4c02f7ab5c803f867f22ec36de5d2e7c8e1aa76
SHA512 97f58de701b676780f8e5b6b184fdce49da7456b9531b541ba3a045e5ecb82ec78bd1aec5c3e851241463035c58f550548c28f131f757d69fd0dca275a5889f3
SSDEEP 768:kyk7u70WvqiEa8F1+UoAYDCx9Tuqh0VfUC9xbog/OV35LlWYSB/roynYf:kyk7u70WvqiEau1jai5LA3Bsbf
TLSH
T16FC2E93B740CCB7E4F801E9DAC566F977E9802C7A6988D4087FA994C02C77EA51264DF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Shared Dictionary\cache\index-dir\the-real-index
Size 72B
SHA256 44e2960218dbe0d5c85b607f9b5abd2367f83f6b517d11664c096034d9b3742b
MD5 854c192c077ff4a9e457d1f6d733df23
SHA1 bc56d9eab1fda9f7600f2c7689b14cec2070f412
SHA512 f8a63fe2534d4149286449d859498de400405de60c165ef6f557dbaa8681a92b823e4d82965833b66d7655b6a9d35545ac0c25e389753f0e314765a91036fc36
TLSH
T166A0021659E11C72CC00867B6ACF019132A06C1063AADF6365AA906E9D9225C718A102
MD5 SHA1 SHA512 TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 97d2a8fcf326f8a122ee385b16e9fba08f394796d44ba0630c4c66779b4babe2
MD5 bd7b6df09c679aaf307274b7190d6798
SHA1 718120faf566c8ec642d0151d380a0f68c62578d
SHA512 7a136b3054667c5ec8696a22fc3d1adb4f2857f7f3859859f0b30f2c5c9dd866b183f1c4baf30d68be4d15cd4515a94a3986efe621651144970d442e2ed20b9b
SSDEEP 96:KIbCKcvNSKWcvFEB1PjvILL+bVNIKdNVHI5ttuH1FC/CT/hBRCLJsxVPCKdnV5:saQFEB1PjvqL+xNJNVHittuH1FC/CT/F
TLSH
T1AB91E605327B0601387E285C91A6C5278FC275A63298E96F3FB845E24F67E124EFC9DD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig~RFe5937c0.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig~RFe5937c0.TMP
Size 3KB
SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
MD5 904e6e94a1d46374c8630cfd86cc729f
SHA1 e1d9c3f7813878acc6510d48d95b2bf48b2e1a0d
SHA512 081e2a26252860ff8d8f7a9d0378ae56f0cc50574d13d2a121afdf74284963747ef874a4d73b1df7774cd8570972f4f513eefe0a0325fd088556d5b1ba946712
TLSH
T1DB815C4FCC0CBE77ABAB6A719A35D6B2F79131EA94518A977F8C444EE3050ED0242E50
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 12KB
SHA256 0e2ab152fed18fd5de78025043f44fe9c584fe16edb9cb43bd6e01a5cbc3937a
MD5 6b55587a58a2ed481fa5311c9c6b6599
SHA1 8e9cada91e9f93d407b41393ad6fb6390bc12895
SHA512 59cfcec5613b1a64225c826f55007b5a039722c747bc3bedb48ca8dd5f2a0aed161b2177e0c3f071adf3e6568ee21a08a812bba1adeff3245ac64bf617927526
SSDEEP 192:ugLsNyOQwfBbIqQmiU14Xx4aGBPKIOCHrWTPNqdNuebqYd/Z:xsNyO7brM+7LCQueX1Z
TLSH
T17B423C36AC759D7A5EA7A201F48937136FB8917BE7C42F40E6DC6B0C01DF698130791A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 27KB
SHA256 d1b8c9bfbb9c4fc8a72905b7f04400c2570ee24758f08677f006fe51165be6ff
MD5 9f30830ba06db7b3348c77a583e34877
SHA1 fdb45b5e85bd01d713fd60049e50275ca6553ee0
SHA512 de7ebcacf4363e0d0bbe36600158028a4c6a49becee041cd0c136bd8ddd40571738a9d1c03694c415ba629d4e21d721c271458e85a0f300490c4f0a05ee6f4e7
SSDEEP 384:5iFiZcIxzsNK8TUNTUlIlAL7brI+oG+7LCXueXOObjI9G6w7Ix:QFQBjwg6P4+oG8yue29MS
TLSH
T16BD229F688D7893AD96E5713B7BD2E125EBCC167F6845640B3D89A0CCC9A0BFC306815
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 12KB
SHA256 1e57609612eb2acd8c35e4ff3e3a81228d3b1ab7e15ed89591fb3b3f14c8699b
MD5 235671355ebedce2e33085d571960808
SHA1 d1a5d1268c9eb94b58ef551d8a81e079d522ea85
SHA512 a63fc239c84c4fca18619443e04f74d1be805aa6dd23f335b7b10a291f8e8ffa2cae2f1c4c892bd0a7ed774f91872921a2abf96134f07c27e4a99c37d734f87d
SSDEEP 192:usLsNyDQwfBbIqQmiU14Xx4aGBPKIOCHrWTPNqdNuebqYd/Z:dsNyD7brM+7LCQueX1Z
TLSH
T1C5523B36AC759D7A4EA7A201F48937136FB8916BE7C42F40E6EC6B0C01DF698130791A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 fc0364bacb975117f78a3cfc88742fa164f312b1d6e45f80b536a3ce579d7d4c
MD5 95d9ad201738dd10035562c69394c0f9
SHA1 bda84774796731b58941c5026738b83ad566761a
SHA512 1791f6e6ed02e5a0a529de04a718585c139f3034e1d6beeedda09f276bda22bce7dcd7336c6176d1aa07c4e166103dd3c53daa6635e599e22268d81d84446822
SSDEEP 192:BONT64BSQmiUyhg65GBPKIOCHrWTPNqWwuebqYU6:BONT6eOz68LCoueXU6
TLSH
T142120A36EC65AC6B5EA2A540F4C636135FA8422BF7856B40EADC7B1C01EF65C230781B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 20KB
SHA256 fc2881cf29746912219440ab189565fdd3de2bb2519fbd04496dc5296670c24e
MD5 a244f61916776a758305a13b5624f490
SHA1 47bda7cc7dba3d00dde00d1f8136212a51b60903
SHA512 f0331dad027dafa150e7e5a5a5c33f5b95b2f9eb7ff7885b03ebd12cd11f6687d5b3619300b3a0e9cf01b97ecf5786ed79b241df2d984faaf7c3971ae0dd39ba
SSDEEP 384:CZcIhsNyAL7brM+7LCQueXOObjI9G6w7Ix:whuPc8/ue29MS
TLSH
T177928E36AC755D369AABA611F4C936135FF8917BF3C81B44A6ECEB0C05EB99C0313816
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

b327a060-5e9d-4452-a94c-f55ede960b1d.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\b327a060-5e9d-4452-a94c-f55ede960b1d.tmp
Size 8KB
SHA256 b67c1fba94368ba07d88ff22182cf18d80e4634c4bbc21e793345b7b910a173e
MD5 7d95bc907d3276e7da9d511d344c671b
SHA1 f370513da8c09eda344e35f0e35e5c932559b63f
SHA512 6220ac3d174eab2e7ca13efe2d12c45ae808b0b32acb87d4dcc1035d3e3b74523b0e80f5dfba4a290ddb8e769b35fa420c869cafd21577fcba84fce66d45542e
SSDEEP 192:MONx64BAQmiUyp1gW5GBPKIOCHruaDuZjU6:MONx6eAGqW8LLuBU6
TLSH
T11302FB39AC796C7B9EB2BE45F48637175FA8113BF6945B44EAE85B1C00D764C230382B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

599f6fb3-2deb-4b6c-8b50-cfb5c5862dc0.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\599f6fb3-2deb-4b6c-8b50-cfb5c5862dc0.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 e30df2bcc744253d4a86bd01d7c1e2903f47f733d62c9cfa53ce22327247a0fb
MD5 3a87ca01104338aa6b8ed92cfab5afae
SHA1 cb3fe973da7495fe2954bc300ca72d2cfd6a4eca
SHA512 20f93c5b5b11517a38e4d2b7f0176f1e57b76c7678242e87c0660be160ffd63ce9b48040748ea28d8762752189806dbca2441d4e002f31f273bda0de004915ac
TLSH
T126414558A7F91144B3B76E1AABFAA96D547B7C732E0AD45E10010E4F0A32F40C9B1B37
MD5 SHA1 SHA512 TLSH

Submit Download