cb090bb43791f56f902edf7798e832134e52668fef57e2d289b150b3e166a4cd

Analysis

max time kernel
148s
max time network
153s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260710-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260710-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
30/07/2026, 21:28

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
.html
Size 516B
Sample260730-1bppgagj21
SHA256 cb090bb43791f56f902edf7798e832134e52668fef57e2d289b150b3e166a4cd
MD5 ad60e0918ad67cc49b228faa8b499267
SHA1 41e315e58fd587edd24364445e45ccfc967c7f1f
SHA512 b7921e26472540e6cd799ae2913b6f78f6e121912abdcbd9b13be45ff5c8829c97b6453d927f5fd9e88dae56852fb6cb558c8ee84b2d12989a590da4c4973394
TLSH
T122F02BE22C581C18477499B90CA45C25C8869313071DD3D3F1FCAA1B1F607B8AAA26CC
MD5 SHA1 SHA512 TLSH

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4204	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134299205339209867"	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2246396966-3025826688-3847171515-1000\{5D8FD28F-AF75-47E5-A38D-4BEE12C0E914}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4904	msedge.exe
4904	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 9 IoCs

pid	Process
5472	msedge.exe
5472	msedge.exe
5472	msedge.exe
5472	msedge.exe
5472	msedge.exe
5472	msedge.exe
5472	msedge.exe
5472	msedge.exe
5472	msedge.exe

Suspicious use of FindShellTrayWindow 33 IoCs

pid	Process
5472	msedge.exe
5472	msedge.exe
5472	msedge.exe
5472	msedge.exe
5472	msedge.exe
5472	msedge.exe
5472	msedge.exe
5472	msedge.exe
5472	msedge.exe
5472	msedge.exe
5472	msedge.exe
5472	msedge.exe
5472	msedge.exe
5472	msedge.exe
5472	msedge.exe
5472	msedge.exe
5472	msedge.exe
5472	msedge.exe
5472	msedge.exe
5472	msedge.exe
5472	msedge.exe
5472	msedge.exe
5472	msedge.exe
5472	msedge.exe
5472	msedge.exe
5472	msedge.exe
5472	msedge.exe
5472	msedge.exe
5472	msedge.exe
5472	msedge.exe
5472	msedge.exe
5472	msedge.exe
5472	msedge.exe

Suspicious use of SendNotifyMessage 16 IoCs

pid	Process
5472	msedge.exe
5472	msedge.exe
5472	msedge.exe
5472	msedge.exe
5472	msedge.exe
5472	msedge.exe
5472	msedge.exe
5472	msedge.exe
5472	msedge.exe
5472	msedge.exe
5472	msedge.exe
5472	msedge.exe
5472	msedge.exe
5472	msedge.exe
5472	msedge.exe
5472	msedge.exe

Suspicious use of WriteProcessMemory 42 IoCs

description	pid	Process	procid_target
PID 5472 wrote to memory of 824	5472	msedge.exe	89
PID 5472 wrote to memory of 4204	5472	msedge.exe	90
PID 5472 wrote to memory of 6044	5472	msedge.exe	91
PID 5472 wrote to memory of 6044	5472	msedge.exe	91
PID 5472 wrote to memory of 6044	5472	msedge.exe	91
PID 5472 wrote to memory of 6012	5472	msedge.exe	92
PID 5472 wrote to memory of 6012	5472	msedge.exe	92
PID 5472 wrote to memory of 1640	5472	msedge.exe	94
PID 5472 wrote to memory of 5036	5472	msedge.exe	93
PID 5472 wrote to memory of 5036	5472	msedge.exe	93
PID 5472 wrote to memory of 5036	5472	msedge.exe	93
PID 5472 wrote to memory of 1640	5472	msedge.exe	94
PID 5472 wrote to memory of 1640	5472	msedge.exe	94
PID 5472 wrote to memory of 6052	5472	msedge.exe	96
PID 5472 wrote to memory of 1960	5472	msedge.exe	97
PID 5472 wrote to memory of 6052	5472	msedge.exe	96
PID 5472 wrote to memory of 6052	5472	msedge.exe	96
PID 5472 wrote to memory of 1960	5472	msedge.exe	97
PID 5472 wrote to memory of 1960	5472	msedge.exe	97
PID 5472 wrote to memory of 4684	5472	msedge.exe	98
PID 5472 wrote to memory of 4684	5472	msedge.exe	98
PID 5472 wrote to memory of 4684	5472	msedge.exe	98
PID 5472 wrote to memory of 6092	5472	msedge.exe	100
PID 5472 wrote to memory of 6092	5472	msedge.exe	100
PID 5472 wrote to memory of 6092	5472	msedge.exe	100
PID 5472 wrote to memory of 3916	5472	msedge.exe	101
PID 5472 wrote to memory of 3916	5472	msedge.exe	101
PID 5472 wrote to memory of 3916	5472	msedge.exe	101
PID 5472 wrote to memory of 3592	5472	msedge.exe	102
PID 5472 wrote to memory of 2444	5472	msedge.exe	103
PID 5472 wrote to memory of 3592	5472	msedge.exe	102
PID 5472 wrote to memory of 2444	5472	msedge.exe	103
PID 5472 wrote to memory of 3992	5472	msedge.exe	105
PID 5472 wrote to memory of 5856	5472	msedge.exe	108
PID 5472 wrote to memory of 5856	5472	msedge.exe	108
PID 5472 wrote to memory of 5856	5472	msedge.exe	108
PID 5472 wrote to memory of 3392	5472	msedge.exe	110
PID 5472 wrote to memory of 1404	5472	msedge.exe	111
PID 5472 wrote to memory of 1132	5472	msedge.exe	112
PID 5472 wrote to memory of 1664	5472	msedge.exe	113
PID 5472 wrote to memory of 1664	5472	msedge.exe	113
PID 5472 wrote to memory of 4904	5472	msedge.exe	115

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument C:\Users\Admin\AppData\Local\Temp\.html
1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:5472
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x260,0x264,0x268,0x25c,0x2d8,0x7ffc2c53c188,0x7ffc2c53c194,0x7ffc2c53c1a0
  2⤵
  PID:824
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1836,i,9050056857262877596,11180869918036511456,524288 --field-trial-handle=2344,i,2650503821999754793,17163567799987272185,262144 --variations-seed-version --mojo-platform-channel-handle=2372 /prefetch:11
  2⤵
  - System Time Discovery
  PID:4204
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1552,i,11270580748522779555,12891945718296685437,262144 --field-trial-handle=2344,i,2650503821999754793,17163567799987272185,262144 --variations-seed-version --mojo-platform-channel-handle=2340 /prefetch:2
  2⤵
  PID:6044
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2488,i,15523904146571486971,12779415244022749467,524288 --field-trial-handle=2344,i,2650503821999754793,17163567799987272185,262144 --variations-seed-version --mojo-platform-channel-handle=2916 /prefetch:13
  2⤵
  PID:6012
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3656,i,8728762412954556070,9951569986354001416,2097152 --field-trial-handle=2344,i,2650503821999754793,17163567799987272185,262144 --variations-seed-version --mojo-platform-channel-handle=3720 /prefetch:1
  2⤵
  PID:5036
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3664,i,14020498760473656853,12709478480257292617,2097152 --field-trial-handle=2344,i,2650503821999754793,17163567799987272185,262144 --variations-seed-version --mojo-platform-channel-handle=3732 /prefetch:1
  2⤵
  PID:1640
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4396,i,13173492370357924968,11219725315534170339,2097152 --field-trial-handle=2344,i,2650503821999754793,17163567799987272185,262144 --variations-seed-version --mojo-platform-channel-handle=4444 /prefetch:9
  2⤵
  PID:6052
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4368,i,12711306714455120221,7094202344013484813,2097152 --field-trial-handle=2344,i,2650503821999754793,17163567799987272185,262144 --variations-seed-version --mojo-platform-channel-handle=4372 /prefetch:1
  2⤵
  PID:1960
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=5312,i,10015344711673714713,12308961205489971578,2097152 --field-trial-handle=2344,i,2650503821999754793,17163567799987272185,262144 --variations-seed-version --mojo-platform-channel-handle=3836 /prefetch:1
  2⤵
  PID:4684
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --always-read-main-dll --metrics-shmem-handle=5420,i,6778254211069795837,16957517341552257301,2097152 --field-trial-handle=2344,i,2650503821999754793,17163567799987272185,262144 --variations-seed-version --mojo-platform-channel-handle=5536 /prefetch:1
  2⤵
  PID:6092
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --always-read-main-dll --metrics-shmem-handle=4352,i,4776404690353793726,12693886212026254375,2097152 --field-trial-handle=2344,i,2650503821999754793,17163567799987272185,262144 --variations-seed-version --mojo-platform-channel-handle=5280 /prefetch:1
  2⤵
  PID:3916
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4436,i,15114896442316265098,15044836915492942190,524288 --field-trial-handle=2344,i,2650503821999754793,17163567799987272185,262144 --variations-seed-version --mojo-platform-channel-handle=5192 /prefetch:14
  2⤵
  PID:3592
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4408,i,12590498431265656513,9885550307709797411,524288 --field-trial-handle=2344,i,2650503821999754793,17163567799987272185,262144 --variations-seed-version --mojo-platform-channel-handle=5144 /prefetch:14
  2⤵
  PID:2444
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6100,i,15858330437410828433,16311020001971502930,524288 --field-trial-handle=2344,i,2650503821999754793,17163567799987272185,262144 --variations-seed-version --mojo-platform-channel-handle=6128 /prefetch:14
  2⤵
  PID:1612
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6100,i,15858330437410828433,16311020001971502930,524288 --field-trial-handle=2344,i,2650503821999754793,17163567799987272185,262144 --variations-seed-version --mojo-platform-channel-handle=6128 /prefetch:14
  2⤵
  PID:3992
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --always-read-main-dll --metrics-shmem-handle=6684,i,15257597619423492643,8695085838491656426,2097152 --field-trial-handle=2344,i,2650503821999754793,17163567799987272185,262144 --variations-seed-version --mojo-platform-channel-handle=6688 /prefetch:1
  2⤵
  PID:5856
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4452,i,1212618017170256715,17233316115346394485,524288 --field-trial-handle=2344,i,2650503821999754793,17163567799987272185,262144 --variations-seed-version --mojo-platform-channel-handle=4560 /prefetch:14
  2⤵
  PID:3392
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4492,i,6674410244765407663,5282267400041933888,524288 --field-trial-handle=2344,i,2650503821999754793,17163567799987272185,262144 --variations-seed-version --mojo-platform-channel-handle=5036 /prefetch:14
  2⤵
  PID:1404
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5096,i,7678204801497366326,6963648335642021360,524288 --field-trial-handle=2344,i,2650503821999754793,17163567799987272185,262144 --variations-seed-version --mojo-platform-channel-handle=4396 /prefetch:14
  2⤵
  PID:1132
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5208,i,3524026312526992757,14908975406732954970,524288 --field-trial-handle=2344,i,2650503821999754793,17163567799987272185,262144 --variations-seed-version --mojo-platform-channel-handle=5532 /prefetch:14
  2⤵
  PID:1664
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=812,i,9648428048310312760,16885753284678896448,262144 --field-trial-handle=2344,i,2650503821999754793,17163567799987272185,262144 --variations-seed-version --mojo-platform-channel-handle=6596 /prefetch:10
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4904

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:1288

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:2336

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

blocklist

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\blocklist
Size 105KB
SHA256 bba2e49c11cb10e1da3782e96a0839de38ec558ccceb0d68515b04792179f852
MD5 34d661b06bc0857903247c15b32b3124
SHA1 72b12aeb58848c0b8474acb525b5e3c41cf32367
SHA512 ff623932c1d85ab3c9cf10c993d26b94c5e1d9968c6a6f9a48925137edcf7379ba3bc8d216e7fc052000ec59dab883f4b498f2262f7941a46d3328c62092e788
SSDEEP 1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P7U:fwUQC5VwBIiElEd2K57P7U
TLSH
T1E0B3A931457E36BF26E93EE828CF1511B84F3912664895D4ABE1FE2C4845E68633CEF4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 08a3eccff4cd9b05162ffe0d083662ea8cd60457899147f42dbbf95a0a97d97e
MD5 394c25b8b347a39d61b9cf28babb5c77
SHA1 c7334bcf8642ac580d30cf31659724fe1ab323c9
SHA512 8e5c09dada01bf020bbf53884d65940c521dc62e17d9ce99fe6c571edde4b95c7c7716f2eda97b70568b2cbac8823e7afed5a9bac7be39d1acc6fc95c23a4b1c
TLSH
T1F6D0C038762962C2C92725B2CC3063007330007030B587425071440C8E3489667CF3C7
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 168dc438fa355b9b84e416f9d4caca14da218ad190d72da09fe489277625815d
MD5 39064a84dfec9bbd8c4b789b6d7a7c62
SHA1 5d817a4df5ed7bd1eac0c4bc0464a76007ad0c46
SHA512 3a4f32a1ad3eb6c391e6d11f4f6ba07c4d21cc935ddd8fd93306857b9e0cfda06c39786a872cae88f394320921a63296ad4df0e61334710db192febec2f48618
TLSH
T1B5D0C034763961C2C92725B2CC3163007320007030B587425171840C8E3489667CF3C3
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 f864508092ae38873f46aedb4bc73e4e928106aff7342eda3d2db2e51d01025b
MD5 d51e1767272234dc4332f44ce73cfb64
SHA1 a029968405e2a3c491bb265427536ac3ea22cdb4
SHA512 2813c23b6a4cb9f334db175b88a3cf406890c6e883561dc571ae97b4b92b1b5bf1caa93cc72fd4c9e8d1191fc37c40d8e22f2249eca42633da0dd6b2a630e95b
TLSH
T163617394132E2EF3EF769F7364F54BC97FF5980A827B1EE020F0A078455AF166009415
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 99adcbba97eb17783eba79f450a6d4a1489d26e12311ea51c44a993239ce22bf
MD5 9ce36ca89a371f97cfe2a85aaa1f0563
SHA1 d9ed4674faf28f369ec71e04cd24221ef095b2a9
SHA512 28e4ab6bee10e5d4783f8681f85a09e3558500dec6234ea4ee55d73db9c63c62b1754032fc849a52d5db00043dcfe5982564f2e71bad9327c5375016f6642ed9
TLSH
T13A719254132E2FF3EB759F7268F49BD97FB48816827B1EE010F4A138089AF1AA009815
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 7183cbd0ff51f203eaa1e4123e9dad496097ec0d49c3c8cb5e21c6f4e61e5469
MD5 f95b559c56869e2aeff817e48133603c
SHA1 b94b8b60edcd3a85c42dc75188a4452b5553282d
SHA512 49c0b893ce60df7e3b1c51ccfb933808250ef5cb751c24992e7cb7efa7b7194bacab8c8679a6a1fd5adef40af8cbc46e5aa8fc732e9432b7688e015d0d952b0a
TLSH
T1AF717454132D2FF3EF759F7368F59BD97FB98806827B1EE010F4A175089AF1AA009815
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5a039b.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe5a039b.TMP
Size 2KB
SHA256 a5a2dc571d2f33f643909ed50d345f26aa23d37472c978cbd32f9124bc46e4ea
MD5 e6e280c482f7846d6cdcce7e512dcd53
SHA1 d360fa778b4a897169b1055a91b07f9607c5345d
SHA512 eec5fb8a736a271865b3bdc21afc8960cb9274d51a773e022d544fc6a1a10bc60bcb9abe47fd3379a21fad1118d49236e11f1cbd098a567552522a9b73e0827b
TLSH
T1EA515094132E0FF3EF368FB348F95BD97FB5994A823B1EE100F0A178499AF296059415
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 3KB
SHA256 46d9459495f0a91508a4307dcf24a7aa75378d6cfacd9a0eecce68c8b3769e97
MD5 a46bf6ea700e40b134cbe63d0f29e580
SHA1 2abc7ed3c67862309a9d44992217c8e5e5ffb140
SHA512 929b31c49ae5ad2eaa1cb5f30a337ea9d0359009f656d3cb9439ea704eae6079e3fe3593a3f4e95961df5fc6c3ba78dd294c3c376af1cfe88b477cbf85c70032
TLSH
T1B5619CF7C3F8952E8A1196F0EB186E1FCE5D0911835C796AC5E4AE1BA3E3471E140A4F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 71096760c680d16dc7bcbcafd771e17fef9c758bb3c1b468494c280d268cf771
MD5 dd0b3850a630f6c7f23495b86eb127e8
SHA1 0385d882dd49b232611c5ce4429605c0a6a2b264
SHA512 e31cc6a9e30129a472a89798beeb2f4f509e2ad603fb7c356cf01353feee5c6297a5eaae3d5f55f11f720366a128f067ff47726d79f6aa2417f0598f76b36c75
SSDEEP 192:sxRjRtbV/f5sMPO/xszoA8p4bJ2Flv/g6+WNA9YZ7PJ6IAGtIgDAJ:sxRj7V/f5sMPO5dP/5OoPlo
TLSH
T1C742B956A964993B9CCBD61EFA55BF53D2F95032A1D01E48ABFC970C04EB6CD230780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 36d01d76b9fd948f0fc7777c2f230f5cda796db11b969243b59e7f81771d6ea3
MD5 2c92f3b0d5741b8903da4ad859d03a81
SHA1 e3f47328a89907f552d063a411c553f571ae4467
SHA512 d0c79d605649c776c44b7a74720eb30f2477360d6b6ac055a76f59690197ef7d98f873e1137e6eb8c959f19d9624b085fadf9e49dde678b0632cf646aab3e711
SSDEEP 192:sxRjRtbV/f5sMPR/xszoA8p4bJ2Flv/g6+WNA9YZ7PKIAGtIgDaJ:sxRj7V/f5sMPR5dP/5Oylq
TLSH
T1A742B956A968993B8CCBD31EFA55BF53D2F95032A1D01E48AAFC971C04DB6CD231780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 6a47097f72315b9e961ead3edb510be79554d294836fa36a4cb4a9830fbcf97f
MD5 a90401d4c348c996186c33198279fb91
SHA1 1671ee9b7a767957ecfd9ba59df6cb0ada44488f
SHA512 c93cb0e1ff7ce6637a631dec22176a57af4bdb937c74c40ec6b9534ebefc231a6d9a99ad6a5ce3e2e6ed943416d4d769e8ae680f29eb4cae4fc90a60422bd2a9
SSDEEP 192:sxR4RtbV/f5s8PR/xszoA8p4bJ2Flv/g6+WNA9YZ7PKIAGtIgIJ:sxR47V/f5s8PR5dP/5Oyls
TLSH
T1AA42BA566968993B8CCBD31EFA55BF53D2F95032A1D01E48BAFC961C04DB6CD130780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 23KB
SHA256 47c887abf3aee37785d0b710291b06ae31ac963734731bc25cf70701f3b985c3
MD5 6294d6b0a2c73a820e74b96d66f9edcb
SHA1 78ee573eb4a83c60a0de074b1dde77ab68d26955
SHA512 2406cdb612eafaa693e05d0cbcab7794f0417a0fe4cd289fcf44df5134dc9f5f545e1b98d0fa41b0d229cd17e2ba439bd245bcb0c945af87d55d3b293aaf9668
SSDEEP 384:kyr2SGXfCtgdDFf/bKhOObJ+UoAYDCx9TuqZz0VfUCh7xbog/OVA89VXR63roOpr:ky2SGvWgd5f/b8F1+UoAYDCx9Tuqh0Vz
TLSH
T12CB2DB2B604DC77F9F801A9DAC196FD77D9802C797588D8047FE990C03C77EA912A4DA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 5KB
SHA256 668dffbcf9af4f90553f28cb253e8e3eed1142be4800cefe2210ab53046defda
MD5 4a9cc48251cb5c3da431e00d541502fc
SHA1 3931bd3304df3166c3bb9f5464fb54f159d7f7e7
SHA512 7580a1d6e94a554f4a25dd33a0c69a2a53aaed13733b616a04367e259ac85dcb35495c7695225144b740bc7bd17c916d66e7e856e7f7c13fce6f96227ca78556
SSDEEP 96:K4POKs0KVLet5jp9bmtgqUBbKMiUHbALT4VysgKVambEXYkmue2suJ9ek2K2TeqJ:I1TK7bEXYkmueVuJkk0Teq58EBa+
TLSH
T1ACC1D1D2B03A824079BE290990B5C627CBC5F0B3745DA4AB3BE810B65B67F415EFD4C9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 36KB
SHA256 e54508ffc5f0435ac969ff4420fcaa6b1f362eb496883fc4819f9f4801191243
MD5 65ce4683ef50c0d3e574b0c2a73447b4
SHA1 e2173b4e48354283178bf75d93608a12272ef81c
SHA512 0942826661cc26ba6d54a3fc8ad7ffc031e275c83f22e0c635faacade35372a5cb6fee35ed4cc32139aee5f531e5f0e01b972c871c9c1d6a7d631b7de82c2e28
SSDEEP 768:6Jrv+4UNbdK3+dqp/Aam6aQMGdjWca4Ghf9MaG:6JbsbY3DJmaME6pM9
TLSH
T122F2AF31A878D9739CB79696F21B7643BEB0516389C80E90D4DD6B0D479B4CE230BD1B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 30KB
SHA256 48bf2cfe1dae6198d2283a75c47e51596862199eba4bed8a1ab5202487fb98f2
MD5 673575e84a92d3aa138799563ead8097
SHA1 64b6fa6f839916dd99b0eda3a1301122c5786dd1
SHA512 794db8e4b9e08be03da3cf165a2b8ef94e7a725c873249c09abb4902d6d0fe72fa9eafcd97dd74d98726a329f9d3cd8b230e654e54e83fa2023b52f24c81a369
SSDEEP 384:33ZcIh38NdxkHmivk/pgPd+dfYbXvcgtWWmkA1QiZh6vPqQMQYeJfjWca4G2KCQv:3/h3Idqp/Aam6aQMGdjWca4Ghf9MoT
TLSH
T1EEE29E319C7489779CA7A6D6F61B3643BDF08163C9C84E80D4DDAB0E069B58E2307D1B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 35KB
SHA256 98ba373c4c5768d93b0148dfbdffa6a6eb4ba626e578ebcc0177303699bbdff6
MD5 3e98528ae530ee7bb204ddef35e8d936
SHA1 8a955fd7aa741ead1561e5d38722f8cc061137c2
SHA512 c3b1e88afd0ec0e97d0201b5c492b7462cb704377017c2aaf9e1bb005dfddd137ca697808ad99dda412bdc6a061a305a3349de9ae338b15eaad4f08f332d42bd
SSDEEP 384:fYZcIS38NdxkHmivk/ggPd+dfYbXvcglWmkA1QiZh6vPqQMQYeJfjWca4G2KCQ9d:fmS3tdq0Aam6aQMGdjWca4Ghf9MoT
TLSH
T17CF239F158E78932CCAE9387A33E2E426DBCC153B5884A40B7D9560DCE964BFD207816
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 34KB
SHA256 509de12d4e7bc8e8ea27512a8dd2267488fc4add5faeff4d32c52c2a1a43c623
MD5 7faca54464056580a14300b64b17e413
SHA1 2b8e7f4900c080d6e228855fc4fafc02315b4004
SHA512 534f871279594183631213f8e52cdaa385ba73dc1f83342c8a793767ab15637917f06e6db99a3a21d7fe235dcd2bc801fbc34e717ef51b276c4452c74a6d3155
SSDEEP 768:/rv+4UNbdq3ayqtAAam6aQMGdjWca4GhfB3PeU/:/bsbc3OKmaME6pvH
TLSH
T147F2BF31A8689973DDB79A99F21B6B87BEF411A385D40E80C9D95B0D43970CE3307D2B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 30KB
SHA256 d741f66d0ee3f67f3cf86d0c265f2ab20dac30ac34e435fae549a83e03ff5ee7
MD5 42b1b27267c6e41f090d620ddb053f16
SHA1 72990f36f5de54b97d31f197c532341161fcd579
SHA512 9ee1d9d9b4f4e2e88e3700b20075c98bdbf93a93c184cef713aa8210b3128d2f86ba5a1f8be255665884f559adaded819acb29b69bb9cc18ca71d3b49f215c2f
SSDEEP 384:63ZcIh38NdwkHmivk/pgPd+dfYbXvcgtWWmkA1QiZh6vPqQMQYeJfjWca4G2KCQv:6/h3zdqp/Aam6aQMGdjWca4Ghf9MoT
TLSH
T134E2AE319C7489779CA7A696F61B3643BDF09263C9C84E80D4DDAB0E079B58E2307D1B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

666085f7-d832-4f04-a570-3540e60d17f4.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\666085f7-d832-4f04-a570-3540e60d17f4.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download