f8ee4e3f0102c732f4ad28ea0e2c0ff86544cc6699b29228abd29f42d033b59c

Analysis

max time kernel
150s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
29/07/2026, 00:21

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
slmesp-vsl9-yt/index.html
Size 6KB
Sample260729-anp8nada28
SHA256 f8ee4e3f0102c732f4ad28ea0e2c0ff86544cc6699b29228abd29f42d033b59c
MD5 036532147e4505a65114117878b14376
SHA1 6e208ab39209a75ff9b3e32c3f7bb91a5c92b90b
SHA512 14374a2bd3d72f815839566cfb4792ae1c3c390cc340d90ecaaf02c055ffcaf181c7d08d12f27f73b1e03fce9ba24a5941599b852b107ecf2c26594bec97092a
SSDEEP 96:XHKxWZzGanF2CZIAowZhrWOpTLVOt8L6RUhqCuL6RUhqCuL6RUhqCuL6RUhqC5:3KxofI56ZhLmq0zCS0zCS0zCS0zC5
TLSH
T120D164718880585C9173C255ABB2FB1AEF2BA167574A6050379E6B734FB132FC42325F
MD5 SHA1 SHA512 SSDEEP TLSH

Score

6^/10

discovery

Malware Config

Signatures

Looks up external IP address via web service 1 TTPs 3 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

discovery

Internet Connection Discovery

T1016.001

flow	ioc
80	api.ipify.org
63	api.ipify.org
64	api.ipify.org

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4636	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134297584702232987"	msedge.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2370214745-1838013427-2987045292-1000\{DB6EA272-CAAC-4561-80C3-0651BAE81700}	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe

Suspicious behavior: EnumeratesProcesses 3 IoCs

pid	Process
3428	msedge.exe
3428	msedge.exe
3428	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
3964	msedge.exe
3964	msedge.exe
3964	msedge.exe
3964	msedge.exe
3964	msedge.exe
3964	msedge.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
3964	msedge.exe
3964	msedge.exe
3964	msedge.exe
3964	msedge.exe
3964	msedge.exe
3964	msedge.exe
3964	msedge.exe
3964	msedge.exe
3964	msedge.exe
3964	msedge.exe
3964	msedge.exe
3964	msedge.exe
3964	msedge.exe
3964	msedge.exe
3964	msedge.exe
3964	msedge.exe
3964	msedge.exe
3964	msedge.exe
3964	msedge.exe
3964	msedge.exe
3964	msedge.exe
3964	msedge.exe
3964	msedge.exe
3964	msedge.exe
3964	msedge.exe
3964	msedge.exe
3964	msedge.exe
3964	msedge.exe
3964	msedge.exe
3964	msedge.exe
3964	msedge.exe
3964	msedge.exe
3964	msedge.exe
3964	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
3964	msedge.exe
3964	msedge.exe
3964	msedge.exe
3964	msedge.exe
3964	msedge.exe
3964	msedge.exe
3964	msedge.exe
3964	msedge.exe
3964	msedge.exe
3964	msedge.exe
3964	msedge.exe
3964	msedge.exe
3964	msedge.exe
3964	msedge.exe
3964	msedge.exe
3964	msedge.exe
3964	msedge.exe
3964	msedge.exe
3964	msedge.exe
3964	msedge.exe
3964	msedge.exe
3964	msedge.exe
3964	msedge.exe
3964	msedge.exe
3964	msedge.exe
3964	msedge.exe
3964	msedge.exe
3964	msedge.exe
3964	msedge.exe
3964	msedge.exe
3964	msedge.exe
3964	msedge.exe

Suspicious use of WriteProcessMemory 35 IoCs

description	pid	Process	procid_target
PID 3964 wrote to memory of 1560	3964	msedge.exe	84
PID 3964 wrote to memory of 4636	3964	msedge.exe	86
PID 3964 wrote to memory of 1708	3964	msedge.exe	87
PID 3964 wrote to memory of 1708	3964	msedge.exe	87
PID 3964 wrote to memory of 1708	3964	msedge.exe	87
PID 3964 wrote to memory of 4488	3964	msedge.exe	88
PID 3964 wrote to memory of 4488	3964	msedge.exe	88
PID 3964 wrote to memory of 4544	3964	msedge.exe	90
PID 3964 wrote to memory of 4016	3964	msedge.exe	89
PID 3964 wrote to memory of 4544	3964	msedge.exe	90
PID 3964 wrote to memory of 4544	3964	msedge.exe	90
PID 3964 wrote to memory of 4016	3964	msedge.exe	89
PID 3964 wrote to memory of 4016	3964	msedge.exe	89
PID 3964 wrote to memory of 2296	3964	msedge.exe	91
PID 3964 wrote to memory of 4392	3964	msedge.exe	92
PID 3964 wrote to memory of 2296	3964	msedge.exe	91
PID 3964 wrote to memory of 2296	3964	msedge.exe	91
PID 3964 wrote to memory of 4392	3964	msedge.exe	92
PID 3964 wrote to memory of 4392	3964	msedge.exe	92
PID 3964 wrote to memory of 4500	3964	msedge.exe	96
PID 3964 wrote to memory of 4500	3964	msedge.exe	96
PID 3964 wrote to memory of 4500	3964	msedge.exe	96
PID 3964 wrote to memory of 2544	3964	msedge.exe	97
PID 3964 wrote to memory of 3380	3964	msedge.exe	98
PID 3964 wrote to memory of 2544	3964	msedge.exe	97
PID 3964 wrote to memory of 3380	3964	msedge.exe	98
PID 3964 wrote to memory of 3428	3964	msedge.exe	100
PID 3964 wrote to memory of 2124	3964	msedge.exe	105
PID 3964 wrote to memory of 4312	3964	msedge.exe	106
PID 3964 wrote to memory of 1152	3964	msedge.exe	107
PID 3964 wrote to memory of 5048	3964	msedge.exe	111
PID 3964 wrote to memory of 5048	3964	msedge.exe	111
PID 3964 wrote to memory of 4804	3964	msedge.exe	115
PID 3964 wrote to memory of 4804	3964	msedge.exe	115
PID 3964 wrote to memory of 3428	3964	msedge.exe	116

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument C:\Users\Admin\AppData\Local\Temp\slmesp-vsl9-yt\index.html
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3964
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x2ac,0x7fff9311c188,0x7fff9311c194,0x7fff9311c1a0
  2⤵
  PID:1560
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1964,i,17197271468918824505,4554146495529945381,524288 --field-trial-handle=2428,i,16646126856466648716,18290759873769238630,262144 --variations-seed-version --mojo-platform-channel-handle=2456 /prefetch:3
  2⤵
  - System Time Discovery
  PID:4636
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1660,i,458715208044910863,1552922137750589540,262144 --field-trial-handle=2428,i,16646126856466648716,18290759873769238630,262144 --variations-seed-version --mojo-platform-channel-handle=2424 /prefetch:2
  2⤵
  PID:1708
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2472,i,5853537618524657201,1371792576169798094,524288 --field-trial-handle=2428,i,16646126856466648716,18290759873769238630,262144 --variations-seed-version --mojo-platform-channel-handle=2596 /prefetch:8
  2⤵
  PID:4488
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3468,i,12188379112186211484,14361387866768232424,2097152 --field-trial-handle=2428,i,16646126856466648716,18290759873769238630,262144 --variations-seed-version --mojo-platform-channel-handle=3508 /prefetch:1
  2⤵
  PID:4016
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3492,i,17080036298489328230,11575978598696045688,2097152 --field-trial-handle=2428,i,16646126856466648716,18290759873769238630,262144 --variations-seed-version --mojo-platform-channel-handle=3504 /prefetch:1
  2⤵
  PID:4544
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4152,i,9636961922059693639,16355848299814769865,2097152 --field-trial-handle=2428,i,16646126856466648716,18290759873769238630,262144 --variations-seed-version --mojo-platform-channel-handle=4268 /prefetch:1
  2⤵
  PID:2296
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4192,i,8354418845707917363,1990512394893277248,2097152 --field-trial-handle=2428,i,16646126856466648716,18290759873769238630,262144 --variations-seed-version --mojo-platform-channel-handle=4332 /prefetch:2
  2⤵
  PID:4392
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=3460,i,15604004697178754879,9182278755144786871,2097152 --field-trial-handle=2428,i,16646126856466648716,18290759873769238630,262144 --variations-seed-version --mojo-platform-channel-handle=4788 /prefetch:1
  2⤵
  PID:4500
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5236,i,18373003330241105408,10027357380684575857,524288 --field-trial-handle=2428,i,16646126856466648716,18290759873769238630,262144 --variations-seed-version --mojo-platform-channel-handle=5196 /prefetch:8
  2⤵
  PID:2544
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5240,i,1764941190790373513,2525933791563081659,524288 --field-trial-handle=2428,i,16646126856466648716,18290759873769238630,262144 --variations-seed-version --mojo-platform-channel-handle=5204 /prefetch:8
  2⤵
  PID:3380
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5816,i,5275206711686872741,2682840416468632818,524288 --field-trial-handle=2428,i,16646126856466648716,18290759873769238630,262144 --variations-seed-version --mojo-platform-channel-handle=5832 /prefetch:8
  2⤵
  PID:3716
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5816,i,5275206711686872741,2682840416468632818,524288 --field-trial-handle=2428,i,16646126856466648716,18290759873769238630,262144 --variations-seed-version --mojo-platform-channel-handle=5832 /prefetch:8
  2⤵
  PID:3428
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4492,i,7271016092167442723,13688232550995576446,524288 --field-trial-handle=2428,i,16646126856466648716,18290759873769238630,262144 --variations-seed-version --mojo-platform-channel-handle=4240 /prefetch:8
  2⤵
  PID:2124
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4480,i,5873744405177387062,3190347268254246120,524288 --field-trial-handle=2428,i,16646126856466648716,18290759873769238630,262144 --variations-seed-version --mojo-platform-channel-handle=4332 /prefetch:8
  2⤵
  PID:4312
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4468,i,13228978504998269432,560094033251011895,524288 --field-trial-handle=2428,i,16646126856466648716,18290759873769238630,262144 --variations-seed-version --mojo-platform-channel-handle=4336 /prefetch:8
  2⤵
  PID:1152
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5832,i,14630026583314500507,6588848111435676838,524288 --field-trial-handle=2428,i,16646126856466648716,18290759873769238630,262144 --variations-seed-version --mojo-platform-channel-handle=4432 /prefetch:8
  2⤵
  PID:5048
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5676,i,12927254084553409177,5033768506003969781,524288 --field-trial-handle=2428,i,16646126856466648716,18290759873769238630,262144 --variations-seed-version --mojo-platform-channel-handle=5448 /prefetch:8
  2⤵
  PID:4804
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1852,i,10392749291906865438,16851146167275752603,262144 --field-trial-handle=2428,i,16646126856466648716,18290759873769238630,262144 --variations-seed-version --mojo-platform-channel-handle=6268 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3428

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:2068

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

blocklist

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\blocklist
Size 105KB
SHA256 8bd193269cbc0101b18807144d6cd741576381f849ecee6df4fd3079b1e2a2ea
MD5 7f4cc8bd47cae9e9cfcbdc3a9dea31d4
SHA1 6406135db9fdcf767dc9e78333ef0cb8dfd551a1
SHA512 894acd81265a2f42a77360eaacfcdb7e50c7d9b0a2718871318cc1ab538e27cb24b8d3dba4cdc1a6de030a8f0012aac3b2f7e8fbaaf939ef83c5f7ce1469a61f
SSDEEP 1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P7S:fwUQC5VwBIiElEd2K57P7S
TLSH
T1A2B3B931457E36BF26E93EE828CF1511B84F3912664895D4ABE1FE2C4845E68633CEF4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 39b8627875fea5ac5c5bfb887da12c15116e3fe81f200852c71d5699102c9044
MD5 e3962be2eb3bd350a67bf6309159a1cc
SHA1 c10632202b95ed6f7f4475b6483bf5196e4c5578
SHA512 d12d4acc23b51c071fbc9bf4db2f0575a6b43ec7894b272035e4c01dfce30099cd3ef90a1009dd1e6284cfbcf7a37fd3b79490739946700a2c61ec578374cbe6
TLSH
T173D08C677A0E7815E72F8231A413E360A76B4072A5629702F324C81DA9BC8D85BE63D7
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 a59087fbda784cffb013f4e2a0bf13a7fca483c48e8a7fc15fa022402eb25d72
MD5 dd54db185d82309b854bfa7657ba4600
SHA1 d01c14e8b4dec85ed2e1671545a868fd7ad4fa95
SHA512 f014ab84dd934b90e006883b74ad349d05f60071e57d2cf0bdf8a9bce118654c92139263e082094b602f6900a71e9a7848754994a2ea88642b2376121b581d07
TLSH
T165D08067354D7815E71F42319413D350576B4072A562D702F314C41D957C4D857D53D7
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 eb50bf3eb52475b896b133872d58c829bd7b00727863e39f51fbc1bc672566b6
MD5 c398ff0bec6541321e2885a57260fc82
SHA1 3c7280add8af4dc3774afb48db5511d30aeeafaa
SHA512 95a8f3fd53b8b477d8ce77cb3387bcea373fdff125a4310e45a72992d523f2ad31b24150db6642de3ef42c524e5270cb3f029b85e30bd1a8a6ef261c70296355
TLSH
T1696183384B130493F32B02F0F5C2162A757381904AA79E4A3D60CAFD591EB26CDC92CD
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 8440f152f32fc2b99795664180cb235de9bb07e8e487ce8b79b6f49e73b92985
MD5 4495fff8702e3b1995a2e5515625da69
SHA1 ffd4b03c9d009ca652e7c51b719049b8abd92e51
SHA512 bafefaef042d50cf3d2b86c1d14183ee5763dfa0327f006a780f6b0d05dc5fb8f1e6a6eb7d2de1a051ac5b98d5d3b52d07cc94a904ebbeb701eaa1d4cb5196c4
TLSH
T17F6170394B134883F32B02F0F5C2162639B381940AA79E4A3D64C9FD691DB27CCD92CD
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe588a0b.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe588a0b.TMP
Size 3KB
SHA256 5442ad01271c34a369ad6c53603c30854352ffafc64abb89614302e7ea78ddaa
MD5 e88ee2db75b91f6ca3f174c6dd80e645
SHA1 588dc5d0b14c3251c8c72348de4608c37aaae261
SHA512 728c40bf5795c358f114eaaba935b0ac658ebfedb2185fe9ce3262e646955f4dcf3c4fa0fe24a37d423e749eb27ce98dcd81911fbf699021fac229c7ba8786ea
TLSH
T11E6183394B134893F32B02F0F4C2162A35B3819409A79E4A3D54CAFD691DB27CCD92CD
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 3KB
SHA256 181dc3e99b5b07632a7dd3148cb53dce4bc299f1d3da008b1c9aac3c70cae214
MD5 832f130914372356a0fe6339df69c4c9
SHA1 23a3ca2e993f7b4f8fd5b84158921c973dec1802
SHA512 5e2a37f70926b1b0f9f161726f545d7111f2420ba25207c8261d07d7f0871be87273e622c2089ae483b8c7821d86ebaf861836f926fbe5d180f68c81f61396f5
TLSH
T14A618BFA83E447BE891192F49B296D2BCD1D1017572C3C528AF4AE0B63B24B1D1027AF
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 8ac0477bdd31486704363b600c719852b30e276586db27e96d2cb0107523372e
MD5 f0959735f6e9259175f0caff568e17e1
SHA1 83fd45f8f6d0568f17000384ffe3fbb498125f03
SHA512 5929a738f84cd273c95e2264dd829b129b7e350ab1401ad5dcd55cebb46d8fc0fc0aa10c33b5a92f5ab156d4d17f76efa50f385bab1632a8597330aed82ddcd8
SSDEEP 192:sxZSRwyM/jK1Ml8UQZkx/fIsAH4IdpHLHW6+WNGYHv5iqIg5xJ:sxZS6qax/fIsAHJrHbGM9
TLSH
T18C52D756AA3899B7CCDBD609F9517F53D6F44473E2900E44A9FCCA0C00E6AED621782F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 16f8f6a32b3d0a12ed64b451bf936e044a69884e7276f48b6e84dca3b7ee26d3
MD5 e054f18dab943663f2b62febc13633dd
SHA1 472eb8e21e0ff3f7669abfacbded58d0afa40139
SHA512 ccd63807a3d6afd031e7e9ddef96e9fc6d86149d07ba4768693661f99d1ca263e686b6fcfea27c5a423ba414943150535164863fda30dc023f541e300b27118a
SSDEEP 192:sxZSRwyM/jK1Ml8Mkx/fIsYR4IdpdLHW6+WNGYHj+EqIgrJ:sxZS6Mx/fIsYRJtHbG/9
TLSH
T1AF42C7566A389977CCDBD209FA557F53D6F50473E2900E84A9FCCA0C04E6AED221782F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 30KB
SHA256 ccf855edd1c2ff3a0d028162c68724674e0e505989874f9ce9a20f6bbfe99a18
MD5 cee632c565039af3bfe4105d264f3988
SHA1 79be824241ea57638f1d16061f279c9196130474
SHA512 f66d3f1f585f3c3b38943a029547e6c4f343c02baef0589bcfc9c8a11a178fc159a2e717fb5ff12d9ef68b30c4af34e50f85968fe22bb7f0ba16fa129be2736b
SSDEEP 768:/eUZYTMWvg0Po8F1+UoAYDCx9Tuqh0VfUC9xbog/OVOeLlPZ4RSroV70K:/eUZYTMWvg0Pou1ja7eLZmRJiK
TLSH
T116D20B2F284CCB7E4F844E9DEC266F963DD801CB9A584D5447EA894C03C72EF512759B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 6KB
SHA256 0fc3313dbfffd9707e3374d5a66722faba4bbe9ad6ee49ff1183a2423e1e2280
MD5 792b3856eeca2bb7fc24e6ee28e000d3
SHA1 6188d2135bc171210fceea586adb07d731c8f586
SHA512 851c02b71437767f4859cc4b6b47465fbbe37606951d64734049f080a8bda646d8b5d8cdc46555cbc98717430d3ccd0107dcad235740404f41bb28fa177c9414
SSDEEP 96:KA1eK2AUkQKJW6+DuKY033yKUAyGbOKUoo:E2bppRdp
TLSH
T16CD1194A70BA12412C7D2A48935497578FC271633228B42B7FBD01B29E67D21DEFD9CD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig~RFe59790e.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig~RFe59790e.TMP
Size 3KB
SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
MD5 904e6e94a1d46374c8630cfd86cc729f
SHA1 e1d9c3f7813878acc6510d48d95b2bf48b2e1a0d
SHA512 081e2a26252860ff8d8f7a9d0378ae56f0cc50574d13d2a121afdf74284963747ef874a4d73b1df7774cd8570972f4f513eefe0a0325fd088556d5b1ba946712
TLSH
T1DB815C4FCC0CBE77ABAB6A719A35D6B2F79131EA94518A977F8C444EE3050ED0242E50
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 19KB
SHA256 8f413461f0ac5d2d5faee15877d78331a830c8e32cf10d66a817fe28cdc8c980
MD5 51dc6edd42e1a7f5708b96e1d8b0a041
SHA1 47cd546a3f249015a5f4995fc7cd9291572ec364
SHA512 8aaae5c796cde78938a5594484a0df78962309cce33f5a006c016a2944984391338ba00ac4c85bbc38df65926bc367449438b1e6aaf1e1dad285b825964c30ae
SSDEEP 384:qZcIhsNwUIQGj5tzX5od+685X8tJrUZqScjmwM:IhvRdFO0GhUg1jY
TLSH
T109926D72A878AC679AF6E545F84B36138FB85073DBC41BC4D6EC6B1C01DA5AC031BC26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 22KB
SHA256 a48d5215178aeb52013361a43ffc24e67575ee19f6eef370bd0d1914aa9b12c6
MD5 b0335fb1705333242c791bb1b4fbf08b
SHA1 c79ef95e5d2d846a7fd65853db93719ae2aecee7
SHA512 f4149c079d9dc469d20d46480670130e6407d9442bf739535306dd01e0d9dbf71c6818e69933e8b5ae689050056d7288d0356d0db385bac03d00ba0dda1c6f79
SSDEEP 384:ZiFiZcI2zsNn8TUNTUlIlnIQGj5tzX5od+685X8tJrJZqScjmwM:wFQGowg2RdFO0GhJg1jY
TLSH
T1EDA25C735868D86BAAF6AA45F84B32138FB450B3DA946B94D3EC5F1C01DB5EC030BD25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 22KB
SHA256 1448eed1ea0a7b90734aef2b9012a8585e7ee73a946536bf3a4e009d5fd491ae
MD5 bc6117b462a81f2d2869b643a947b850
SHA1 4c4d487d88cb203f13f68cd24815b7dd297f9a68
SHA512 7ed52db07209d523c17b545278573f1d63db77f39662613a52cab1d25da0ff60141d9bd0bd23ccde0ada8c3be1f14bf29c1c26efcd3aebaabb25fb65cef48b19
SSDEEP 384:OFiZcI2zsNw8TUNTUlIlnIQGj5tzX5od+685X8tJriZqScjmwM:OFQG1wg2RdFO0Ghig1jY
TLSH
T12EA25C735868D86BAAF6EA45F84B36138FB450B3DA946BD0D2EC5F1C01DB1AC031BD25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 673f98ff62c06328ef513faae86f9ef141bf891d0237eabd0c44e5037757ed9e
MD5 59d90f85e1aaf42051dc9e0291da43c7
SHA1 6cc79aa92abf7d907ffd8882bc1cf130ee65cae6
SHA512 a4efbb8de44909aa2ca3615e1b12ae0c680758adf673426e3529e6618c227ed0a98d32e13853adb79ba0d94f598fed28007ed1cf4abb379737b1b53a05d42602
SSDEEP 192:yONo61VWQmiUynigGX5Obd+jqjzorvmk/aj3FOgU6:yONo6WLgGX5od+68U5OgU6
TLSH
T1E302D93568687CAB8EE3BE49B44737135F952177EA542F84D6EC1B1C00D769C2306C27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 0c71cda466135335c9d757a502ab37391db3790cc8b6d05183d4f3cae1058b3a
MD5 ce2c7636b6ac614aaa9f3dce0c3dad64
SHA1 2d2d8c8acfda20be715703b78c43e3498c9af707
SHA512 69e6f4c9c0e5c7258de5718c4fa1899d6f16a3f6e21bf8f2e359b0a692e0fa1997ee2ff0af6e4d0a423a34b737f7a74e3ede8c621cd96483f385013e6381adfb
SSDEEP 192:gONJ616WQmiUyNivGX5Obd+jqjzorvmsX8ySJrkjJZcqEU6:gONJ6n/vGX5od+685X8tJrcZqU6
TLSH
T133120932A468AC6B5ED3B585B44B32135FA85127EB897FC4D2EC2F1C01DB69C530AC27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 20KB
SHA256 716ee574e38284d59cc5ac7024b50a5ffe15f9673a88bdaee1103020e531e4ef
MD5 501742c987630c17687ec35dc7d527f3
SHA1 e951989b33133b7c5e5da052c73d9e600f95b091
SHA512 7ba979b1fedd5cf06059f5e07505af8fdc4e1055e51e9e29226da46521998d526f35455453aadeb61bd0040133eeade17bc10dbece410a89095aadffbe42b289
SSDEEP 384:lZcIhsNwnIQGj5tzX5od+685X8tJrUZqScjmwM:dhURdFO0GhUg1jY
TLSH
T111927D72A878AC679AF6E545F84B36138FB85073DBC41BC4C6EC6B1D01DA5AC031BC26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\metadata.json
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 de69d29f50dd56b3f84d6bae8d891171ea670196f123021c7e6c49aa4c7ffb90
MD5 33c45b626945c979e5de7049415d01a5
SHA1 63bb162c085466293dd209e6e00cf03db32b25fb
SHA512 9f7cd6878e52ada6c642c5a063909fa552be6a60b2b3ff1409aba3f6efda69c1ab834142e5a1ac5f74f447c5fc8b1eecc52664deac0baf28d59293db14997307
TLSH
T1B241565DBAE91118F3B77F5AABF7686D587E78372E06D49D10110D4F0A26A00C871B37
MD5 SHA1 SHA512 TLSH

Submit Download