b027001b20130d3e90aa79073ebfdecd8512cec3e6be8f1c9680312184f00670

Analysis

max time kernel
148s
max time network
144s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
29/07/2026, 00:21

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
slmesp-ps-vsl9-yt/index.html
Size 4KB
Sample260729-anp8nada28
SHA256 b027001b20130d3e90aa79073ebfdecd8512cec3e6be8f1c9680312184f00670
MD5 e4464e62f5281383786eff8bf021beca
SHA1 d3ec0ceefdd22211343f2345a33e96ae56d2dae0
SHA512 830645881c97e03b62fc6083e28f9529b459a9b43e4b9cadb437de95c55f209ccfded2fdc104030d96e03fb657dd0bef7e4f6d18640c0724a7aae331028b2c06
SSDEEP 96:0vY85MnQVv63RjOU2ephOF8aob/F6WK9WUZJeP2psTKVaG40Zh/5U8jL6RUhqCU:0vY8ycv6hjO9eTOF8aob/FpjUZJ22psh
TLSH
T1CBA1D8576C930113740395693BB7BB4726B4E027E105C8787FED9295CF8BA9CC4A7B88
MD5 SHA1 SHA512 SSDEEP TLSH

Score

6^/10

discovery

Malware Config

Signatures

Looks up external IP address via web service 1 TTPs 3 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

discovery

Internet Connection Discovery

T1016.001

flow	ioc
26	api.ipify.org
27	api.ipify.org
31	api.ipify.org

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4348	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134297584764380307"	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1875162379-3804078649-638427191-1000\{B0BFE098-8A87-4084-8863-CFA4E2ECE9F7}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
5224	msedge.exe
5224	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
5104	msedge.exe
5104	msedge.exe
5104	msedge.exe
5104	msedge.exe
5104	msedge.exe

Suspicious use of FindShellTrayWindow 33 IoCs

pid	Process
5104	msedge.exe
5104	msedge.exe
5104	msedge.exe
5104	msedge.exe
5104	msedge.exe
5104	msedge.exe
5104	msedge.exe
5104	msedge.exe
5104	msedge.exe
5104	msedge.exe
5104	msedge.exe
5104	msedge.exe
5104	msedge.exe
5104	msedge.exe
5104	msedge.exe
5104	msedge.exe
5104	msedge.exe
5104	msedge.exe
5104	msedge.exe
5104	msedge.exe
5104	msedge.exe
5104	msedge.exe
5104	msedge.exe
5104	msedge.exe
5104	msedge.exe
5104	msedge.exe
5104	msedge.exe
5104	msedge.exe
5104	msedge.exe
5104	msedge.exe
5104	msedge.exe
5104	msedge.exe
5104	msedge.exe

Suspicious use of SendNotifyMessage 16 IoCs

pid	Process
5104	msedge.exe
5104	msedge.exe
5104	msedge.exe
5104	msedge.exe
5104	msedge.exe
5104	msedge.exe
5104	msedge.exe
5104	msedge.exe
5104	msedge.exe
5104	msedge.exe
5104	msedge.exe
5104	msedge.exe
5104	msedge.exe
5104	msedge.exe
5104	msedge.exe
5104	msedge.exe

Suspicious use of WriteProcessMemory 30 IoCs

description	pid	Process	procid_target
PID 5104 wrote to memory of 852	5104	msedge.exe	88
PID 5104 wrote to memory of 4348	5104	msedge.exe	90
PID 5104 wrote to memory of 2696	5104	msedge.exe	91
PID 5104 wrote to memory of 2696	5104	msedge.exe	91
PID 5104 wrote to memory of 2696	5104	msedge.exe	91
PID 5104 wrote to memory of 3732	5104	msedge.exe	92
PID 5104 wrote to memory of 3732	5104	msedge.exe	92
PID 5104 wrote to memory of 5440	5104	msedge.exe	94
PID 5104 wrote to memory of 5440	5104	msedge.exe	94
PID 5104 wrote to memory of 5440	5104	msedge.exe	94
PID 5104 wrote to memory of 6124	5104	msedge.exe	95
PID 5104 wrote to memory of 6124	5104	msedge.exe	95
PID 5104 wrote to memory of 6124	5104	msedge.exe	95
PID 5104 wrote to memory of 1892	5104	msedge.exe	96
PID 5104 wrote to memory of 1892	5104	msedge.exe	96
PID 5104 wrote to memory of 1892	5104	msedge.exe	96
PID 5104 wrote to memory of 5704	5104	msedge.exe	97
PID 5104 wrote to memory of 5704	5104	msedge.exe	97
PID 5104 wrote to memory of 5704	5104	msedge.exe	97
PID 5104 wrote to memory of 5940	5104	msedge.exe	100
PID 5104 wrote to memory of 2412	5104	msedge.exe	99
PID 5104 wrote to memory of 5940	5104	msedge.exe	100
PID 5104 wrote to memory of 2412	5104	msedge.exe	99
PID 5104 wrote to memory of 2308	5104	msedge.exe	102
PID 5104 wrote to memory of 2976	5104	msedge.exe	106
PID 5104 wrote to memory of 1000	5104	msedge.exe	107
PID 5104 wrote to memory of 892	5104	msedge.exe	108
PID 5104 wrote to memory of 3116	5104	msedge.exe	109
PID 5104 wrote to memory of 3116	5104	msedge.exe	109
PID 5104 wrote to memory of 5224	5104	msedge.exe	111

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument C:\Users\Admin\AppData\Local\Temp\slmesp-ps-vsl9-yt\index.html
1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:5104
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x260,0x264,0x268,0x25c,0x288,0x7ffc1f45c188,0x7ffc1f45c194,0x7ffc1f45c1a0
  2⤵
  PID:852
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1840,i,16621601305253959708,1390807405366076808,524288 --field-trial-handle=2580,i,18113973828450175569,7676266536161331958,262144 --variations-seed-version --mojo-platform-channel-handle=2656 /prefetch:11
  2⤵
  - System Time Discovery
  PID:4348
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1604,i,13756610345890256192,16905229522652907562,262144 --field-trial-handle=2580,i,18113973828450175569,7676266536161331958,262144 --variations-seed-version --mojo-platform-channel-handle=2572 /prefetch:2
  2⤵
  PID:2696
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2224,i,18159518534608564,6996869295602442519,524288 --field-trial-handle=2580,i,18113973828450175569,7676266536161331958,262144 --variations-seed-version --mojo-platform-channel-handle=2680 /prefetch:13
  2⤵
  PID:3732
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3684,i,17327379706348250817,9992784881468807292,2097152 --field-trial-handle=2580,i,18113973828450175569,7676266536161331958,262144 --variations-seed-version --mojo-platform-channel-handle=3708 /prefetch:1
  2⤵
  PID:5440
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3724,i,6761009562720052456,5302293043081509197,2097152 --field-trial-handle=2580,i,18113973828450175569,7676266536161331958,262144 --variations-seed-version --mojo-platform-channel-handle=3728 /prefetch:1
  2⤵
  PID:6124
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4380,i,8496980822404731780,16228146452066098757,2097152 --field-trial-handle=2580,i,18113973828450175569,7676266536161331958,262144 --variations-seed-version --mojo-platform-channel-handle=4892 /prefetch:1
  2⤵
  PID:1892
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4488,i,15213734628904576416,15522067869937473256,2097152 --field-trial-handle=2580,i,18113973828450175569,7676266536161331958,262144 --variations-seed-version --mojo-platform-channel-handle=4896 /prefetch:9
  2⤵
  PID:5704
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3824,i,9640034396269627042,4434155106809471358,524288 --field-trial-handle=2580,i,18113973828450175569,7676266536161331958,262144 --variations-seed-version --mojo-platform-channel-handle=5416 /prefetch:14
  2⤵
  PID:2412
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5408,i,16411236816894195275,1033917173081873649,524288 --field-trial-handle=2580,i,18113973828450175569,7676266536161331958,262144 --variations-seed-version --mojo-platform-channel-handle=5436 /prefetch:14
  2⤵
  PID:5940
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5964,i,1059526928780400409,16766899665432903417,524288 --field-trial-handle=2580,i,18113973828450175569,7676266536161331958,262144 --variations-seed-version --mojo-platform-channel-handle=5984 /prefetch:14
  2⤵
  PID:3384
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5964,i,1059526928780400409,16766899665432903417,524288 --field-trial-handle=2580,i,18113973828450175569,7676266536161331958,262144 --variations-seed-version --mojo-platform-channel-handle=5984 /prefetch:14
  2⤵
  PID:2308
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4928,i,7223479994655792765,11422009656690836833,524288 --field-trial-handle=2580,i,18113973828450175569,7676266536161331958,262144 --variations-seed-version --mojo-platform-channel-handle=3768 /prefetch:14
  2⤵
  PID:2976
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4900,i,10648109908483308686,16826253146970713595,524288 --field-trial-handle=2580,i,18113973828450175569,7676266536161331958,262144 --variations-seed-version --mojo-platform-channel-handle=5184 /prefetch:14
  2⤵
  PID:1000
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5256,i,6617140980846852336,16969606309656157229,524288 --field-trial-handle=2580,i,18113973828450175569,7676266536161331958,262144 --variations-seed-version --mojo-platform-channel-handle=5244 /prefetch:14
  2⤵
  PID:892
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5408,i,17808311384229726744,3393310760193154611,524288 --field-trial-handle=2580,i,18113973828450175569,7676266536161331958,262144 --variations-seed-version --mojo-platform-channel-handle=3568 /prefetch:14
  2⤵
  PID:3116
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=5232,i,6871645605441157891,1152369861526095113,262144 --field-trial-handle=2580,i,18113973828450175569,7676266536161331958,262144 --variations-seed-version --mojo-platform-channel-handle=6424 /prefetch:10
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5224

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:6084

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:2812

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

594e1cb5-b721-4a38-8160-c51d14a5c54a.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\594e1cb5-b721-4a38-8160-c51d14a5c54a.tmp
Size 38KB
SHA256 e957bb0671c58a71c8463e236b930347c31973e9aebda2e8e8122e58a65dc852
MD5 025d6c1de0db4cbb8103280c14dbf2f1
SHA1 f3e56881bed6b8cb0f1062f1e28fca5708e05bff
SHA512 a5910632a28d0224800f31caed432595669b71804a3da20a0ff9baec81883643cdbbe18e15a7b7364975ce034ec70ba2e1d3a3c4e2526ab7bf8a7e913a0661fa
SSDEEP 768:rrv+4UNbdS3xmi0ZrEnjN3Gac1Z6eVH1SCz:rbsbg32ZQnjMaxEH1V
TLSH
T1D903CF3669B88EB38CEBA38571477A037FF4525386940BE4CACD6B0D06975EC130B967
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

602dea19-63dd-4040-a448-e861273dcbd9.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\602dea19-63dd-4040-a448-e861273dcbd9.tmp
Size 35KB
SHA256 8044462428da506089156df59fbd6c0a18c3d10b052090cf21cdb5ec444b3511
MD5 e74f6612bf986ed2294f4bd130bf7e11
SHA1 b76d88eceb1276d86fb4a1eaf71a20d92f044c37
SHA512 0cfb9a621d62af4d82f13010fcd74c70a956286009b9faf6571f0bfb3f864417c6dc545f17ad1d3e3d70dc10d4044edb9e952cec8c998a15dcf1b003c92fd86f
SSDEEP 384:CZcI638NWLV+Sk+5WZlf8hyEGGnFiROY5y2rEoajo4cdR8eHhVODjYPNDUMtP3cN:w639jui0VRPfrEnjN3Gac1FtMjR
TLSH
T161F2B0B56DB48DB38CFAE38275437B12AEE05653C5D40B9485DDBA0D06D76EC130B827
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

82b041d6-3f20-484f-9819-1bd8d8631bb2.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\82b041d6-3f20-484f-9819-1bd8d8631bb2.tmp
Size 38KB
SHA256 9e1ec9c7d878950ca9136bf495fa4740d1bf28c15fe9991f924d3c36afa29e76
MD5 33f5dfb48689bac6f9d8bcae6b148067
SHA1 74f4c24bfc0e78bd645d7d171219ab5b5d7e1732
SHA512 1f80982d8349e53ac8ece4bf79a3e3bccd5a92a9b3c1806d9ecb88c185db73c3335a14e243b7ba1f740e5adbf029c53a1bd8e3d91527cf19ce6cb18d2fa11d1e
SSDEEP 384:OiFiZcIl38NW8TUNTUlIlLV+Sk+5WZlf8hyEGGnFiROYSy2rEoajo4cdR8eHhVOp:lFQl3dwgzjui0VRPurEnjN3Gac1FtMjR
TLSH
T15C03BFB35DA4C9B7DDFADB82B5463602AEE042A3C9D44A9497CDAD0D11D75EC030BC26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 ecdd5c8034c45eff453cbaf31d8886e2bd9609a73853367a6d096a69cc81f1be
MD5 a774534a956a5c8affebe08e87c80683
SHA1 b3e4e20a91e4087d3b9247b5ef6815f51858a041
SHA512 27769aee2cac148a0154fe42b51da2a9a1088e9e990873915b4c7ab9bd5442a3facf82b2bd1cbaef75328bd5937813698b96ac06aa76d934d07ab5ebb194a824
TLSH
T103D09B6673449A1CC9C439712461565161115820E41443581C96715CCDE56C707571DE
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 dfacefa73d018d54e3feba3eef28ec722a8422fee8768a2c3d8d6253f863b375
MD5 cb5000b6fab1115bfff50bedcc3eb9fd
SHA1 afbfe0ec03df59e7a1eba1da4227111508419c03
SHA512 aab9a1afd5de2f983466724b6ecf0dbc2e176c5a1eb2f059b9507511cc53643fcf9ed990bd565f22f8d53fb82db71cba238962a75c68db02d5f10b526661bd08
TLSH
T15AD09B667354991CC9C439712462565161015820941443581D96B16CCDE56C707561DA
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 7b0e59f39d7b2818db04a590d0faaa791ddb27af27f6d1f7f622e747faf0e664
MD5 f5da57f024b72fac671db546d9f561a5
SHA1 ac310bdc400e0b92f50f0cdf3ff5086b14a35b12
SHA512 b83ab81d823029c1a6b882f934a74c3a670ee8e9ea81e95f13ec009064335df010ba01c3bd48d7581996bec648eeb5ca330ab9a2396917d08c291ac09854b24c
TLSH
T13F619398F32A0BD8DB256ABD10D254A7B2F4A521030B6E144C633CB45A73F84B4E3B67
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5998db.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe5998db.TMP
Size 3KB
SHA256 1d03c7a15e565bc3e39d47fad2ea667c5954e158da8464d92e67d96d3f7de894
MD5 e1fdf1a6e72f040d27ae4e2270f4b5ad
SHA1 a185827c598a98630aa9e2c9319c2987fbfc0235
SHA512 56b45afb5cef36c09ba6b877c9a92836b284d797dbd4e64fd53f6cc4e8a32fa7858b6ad97679d12a947de1e05604ad159e190c86686587c373c03997293a2a42
TLSH
T13661A498F32A0BD8DB296ABD54D254A7B2F4B521030B5E144C633CB45A73F84B4E3B67
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 cb4cd6f9c8f13339437a495d2b29743b71afd38a8346195b62e21c6be552f11b
MD5 056b1c4d44af3c21344b3a76e4a5b7af
SHA1 3f7152f9ae795af50367be9d6c193596f6032963
SHA512 06888052d3181b456a2d4cd920e5901e9f0e6563698ba25db9e8ecf8d6a53c82a18e5a35ab300d2739fc40197a9d71ce2820c5608dfdf01ffe3fff9a03e1b68b
TLSH
T175519DF783E4867E891156F0AB146E2BCE1C051A432C7C56C9E4AF1B67F28B1E14165F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 520ac70a05f5b909c2b608dd82debc6b7f3f7bc6c77f07cabd89101fca61a059
MD5 e91e047361822216b2aa44583824f9b0
SHA1 335a43f0bb6bac3f75c54ca13b0f84a7cba26ebf
SHA512 a8093fca62ccbcc1a6ec99b37833f6406ed88061339cc6915be65b2252d3abb2579fd3ce1462e830746ca9f5e3c7a847e96c54db5f8205f80213c1100a79f474
SSDEEP 192:sxRfRebH/fQsRKZz7KCA94/jzoA8p4q/g6+WNIYD976SaGzfIgDXJ:sxRf6H/fQsRKZ/Z85b/5I/SdV
TLSH
T12242C61A59289D7B8CC7E61DBB557F53D2F95032A1D01E08A7FC9A0C04E76DE630780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 8c8a9d07aa92ce9942b283c0f3bca3c24044312c6a3bffe44f9a8d73fa64cc9b
MD5 e46bd39f6c27dad95633ca7201d3db50
SHA1 46a265b3934d63c3ce6a7c2dc69f5b2dffd34c4b
SHA512 7f8b0578cb4a088047bc9e0c4a8b3656cd6b663f00ae723a31ba026d98ad7b0eec4a5d4a94f80d9b3ed2aaf8f21ed5f9600290d31d6e3478a19197aa61b8a394
SSDEEP 192:sxRoRebH/fQsTKZvKCA94/jzoA8p4q/g6+WNIYD986SaGzfIgIJ:sxRo6H/fQsTKZvZ85b/5ISSds
TLSH
T13E32D7165A28A97B8CC7E21DBB557F53D2F95032A1D01E58B7FC9A0C04EB6DE230780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 31df965b0c34ccadb31fbc420ef71e7caf5ee8667b1b731f03d6724fd8aaba36
MD5 3a6ed5021590025a2c7d3d2b440e7e04
SHA1 8b62d379f06a1b40506c25741558262bd5f66e4d
SHA512 50f8c520558b3287d57e8d032a3532382d4690019971cec1753860f60933834ef22a0c11108a477bb788637b506389f7e374a68ad32d2f53822b29f7c5b47d2c
SSDEEP 192:sxRfRebH/fQsRKZvKCA94/jzoA8p4q/g6+WNIYD986SaGzfIgDBJ:sxRf6H/fQsRKZvZ85b/5ISSdX
TLSH
T12332D71659289D7B8CC7E21DBB557F53D2F95032A1D01E08A7FC9A0C04E76DE631780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 23KB
SHA256 753a275080fd9557d3b76be9f325dcb8ad6bad699dd92d3e9144218bff159734
MD5 5a2098683cab941d92afe6cc02f3c851
SHA1 bb2c7bcc3613fde23ed60fc5f64df2ba0fb10b67
SHA512 4900ab3aa076bf90767d55364666fd510b16d97ad1daee9d27914246622dd6c331e8103af6533d5028759029b771704cf3410d5b77f54a42ff4b0b5633119772
SSDEEP 384:a8YfWRmfCtg/NFfHfKhOObJ+UoAYDCx9TuqZz0VfUCh7xbog/OVOe91bRcDropDr:azfWR0Wg/XfHf8F1+UoAYDCx9Tuqh0VY
TLSH
T1A1B2EA2F200CCB7E5F810AADAD196FD77D9802C79B588D5047FE994C02C77EA921A4DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 fd3efd10148277c4275d974084dc9ca4d82ca11852ceab87f29b077a19856a73
MD5 b4e557274f41e5a2bcd19c841e361fb4
SHA1 e53bffea3f9cdbd32d4884dcbc99a08ce8a1256a
SHA512 725b20f197aa3193c02cc1c5568580a5a0b07d1944a8b99711ae762c9828e8120b9345fbd3353c56a3d48aacd0a4fa0bf7133eef61bf7d741f4de9eed28302e0
SSDEEP 96:KRB+PrZ7/LWPM6gTLK4ygdLcBpk3/4HklQUuSW0Wyf/gc0K4xgW0cUUfOPYgKdGo:CB+PrZ7/KPMrTxygd4Bpk3/4HklQUuSQ
TLSH
T14E91AA44317A1680393E750895BA8C6B82C2F4633047A96F77A812628F67E53CDFDDDD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

OperationConfig

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig~RFe5a3104.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig~RFe5a3104.TMP
Size 3KB
SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
MD5 904e6e94a1d46374c8630cfd86cc729f
SHA1 e1d9c3f7813878acc6510d48d95b2bf48b2e1a0d
SHA512 081e2a26252860ff8d8f7a9d0378ae56f0cc50574d13d2a121afdf74284963747ef874a4d73b1df7774cd8570972f4f513eefe0a0325fd088556d5b1ba946712
TLSH
T1DB815C4FCC0CBE77ABAB6A719A35D6B2F79131EA94518A977F8C444EE3050ED0242E50
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 35KB
SHA256 327a1c2532364a1c213fa8bcd937d97ee2e61a6044a3c0e61b810bbb859edf7e
MD5 1d901f78a46046c08ed1e34e978355dc
SHA1 6b26335de4e21fe0e092ae1300d2dc62273fd301
SHA512 db0aed2e246a4485427228c091ab97bdfa9e574fafff99c262579a3c2d52eba2186ef265fbc8c932621ab7b6954e335b490a5cc38052e37bddcbe54fd930a559
SSDEEP 384:6ZcI638NWqV+S1+5WZlf8hyEGGnFiROYAy2rEoajo4cdR8eHhVODjYPNDUMtP3cN:463sKui0VRPUrEnjN3Gac1FtMjR
TLSH
T13FF2B0B56DB48DB38CFAE38675437702AEE05653C5D40B9489DDBA0D06D76EC130B827
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

4927925c-93e3-4652-aac5-d679464f2b73.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\4927925c-93e3-4652-aac5-d679464f2b73.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download