680b4bdd0513af50e123e3673b2bb78eaf8cd8df0e3cf89f71ea9f5fc7c02767

Analysis

max time kernel
148s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
31/07/2026, 18:28

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
sample.html
Size 461B
Sample260731-w4mncsdr71
SHA256 680b4bdd0513af50e123e3673b2bb78eaf8cd8df0e3cf89f71ea9f5fc7c02767
MD5 f13bf062dff22319caae7131772321e1
SHA1 918e6e0d28845696b9efe4b0b8b466ef8cbe8de0
SHA512 755e4619a554ea85e3d23200f880bff4b4c9fe38acf249dbe3ca8715cbab6a69c7dd59cd3a67e3331d4beb6f4520ebb2e13fd0c39a0b6fb3299acb0dcc9218ff
TLSH
T1A7F05C4188E08A0712304665AD91F5184E56E687C7849D0872AAA07E5F887C28EDF4B8
MD5 SHA1 SHA512 TLSH

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
2804	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134299961332479142"	msedge.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-204488895-2999877624-296153668-1000\{346E187C-D2F0-42F4-936B-03AE990539C0}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3020	msedge.exe
3020	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
3976	msedge.exe
3976	msedge.exe
3976	msedge.exe
3976	msedge.exe
3976	msedge.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
3976	msedge.exe
3976	msedge.exe
3976	msedge.exe
3976	msedge.exe
3976	msedge.exe
3976	msedge.exe
3976	msedge.exe
3976	msedge.exe
3976	msedge.exe
3976	msedge.exe
3976	msedge.exe
3976	msedge.exe
3976	msedge.exe
3976	msedge.exe
3976	msedge.exe
3976	msedge.exe
3976	msedge.exe
3976	msedge.exe
3976	msedge.exe
3976	msedge.exe
3976	msedge.exe
3976	msedge.exe
3976	msedge.exe
3976	msedge.exe
3976	msedge.exe
3976	msedge.exe
3976	msedge.exe
3976	msedge.exe
3976	msedge.exe
3976	msedge.exe
3976	msedge.exe
3976	msedge.exe
3976	msedge.exe
3976	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
3976	msedge.exe
3976	msedge.exe
3976	msedge.exe
3976	msedge.exe
3976	msedge.exe
3976	msedge.exe
3976	msedge.exe
3976	msedge.exe
3976	msedge.exe
3976	msedge.exe
3976	msedge.exe
3976	msedge.exe
3976	msedge.exe
3976	msedge.exe
3976	msedge.exe
3976	msedge.exe
3976	msedge.exe
3976	msedge.exe
3976	msedge.exe
3976	msedge.exe
3976	msedge.exe
3976	msedge.exe
3976	msedge.exe
3976	msedge.exe
3976	msedge.exe
3976	msedge.exe
3976	msedge.exe
3976	msedge.exe
3976	msedge.exe
3976	msedge.exe
3976	msedge.exe
3976	msedge.exe

Suspicious use of WriteProcessMemory 32 IoCs

description	pid	Process	procid_target
PID 3976 wrote to memory of 4316	3976	msedge.exe	86
PID 3976 wrote to memory of 2804	3976	msedge.exe	88
PID 3976 wrote to memory of 3452	3976	msedge.exe	89
PID 3976 wrote to memory of 3452	3976	msedge.exe	89
PID 3976 wrote to memory of 3452	3976	msedge.exe	89
PID 3976 wrote to memory of 1216	3976	msedge.exe	90
PID 3976 wrote to memory of 1216	3976	msedge.exe	90
PID 3976 wrote to memory of 4448	3976	msedge.exe	91
PID 3976 wrote to memory of 4448	3976	msedge.exe	91
PID 3976 wrote to memory of 4448	3976	msedge.exe	91
PID 3976 wrote to memory of 3956	3976	msedge.exe	92
PID 3976 wrote to memory of 3956	3976	msedge.exe	92
PID 3976 wrote to memory of 3956	3976	msedge.exe	92
PID 3976 wrote to memory of 4596	3976	msedge.exe	93
PID 3976 wrote to memory of 560	3976	msedge.exe	94
PID 3976 wrote to memory of 4596	3976	msedge.exe	93
PID 3976 wrote to memory of 4596	3976	msedge.exe	93
PID 3976 wrote to memory of 560	3976	msedge.exe	94
PID 3976 wrote to memory of 560	3976	msedge.exe	94
PID 3976 wrote to memory of 1492	3976	msedge.exe	103
PID 3976 wrote to memory of 4648	3976	msedge.exe	104
PID 3976 wrote to memory of 1492	3976	msedge.exe	103
PID 3976 wrote to memory of 4648	3976	msedge.exe	104
PID 3976 wrote to memory of 3912	3976	msedge.exe	106
PID 3976 wrote to memory of 4692	3976	msedge.exe	116
PID 3976 wrote to memory of 4312	3976	msedge.exe	117
PID 3976 wrote to memory of 3316	3976	msedge.exe	118
PID 3976 wrote to memory of 2844	3976	msedge.exe	124
PID 3976 wrote to memory of 2844	3976	msedge.exe	124
PID 3976 wrote to memory of 3928	3976	msedge.exe	127
PID 3976 wrote to memory of 3928	3976	msedge.exe	127
PID 3976 wrote to memory of 3020	3976	msedge.exe	129

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument C:\Users\Admin\AppData\Local\Temp\sample.html
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3976
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x2f0,0x7ffa61dcc188,0x7ffa61dcc194,0x7ffa61dcc1a0
  2⤵
  PID:4316
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1956,i,10042588432813188458,6731683250768355976,524288 --field-trial-handle=2324,i,5152689031329309691,8682409699565705484,262144 --variations-seed-version --mojo-platform-channel-handle=2360 /prefetch:3
  2⤵
  - System Time Discovery
  PID:2804
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1656,i,13447508907910437462,6050325268640948228,262144 --field-trial-handle=2324,i,5152689031329309691,8682409699565705484,262144 --variations-seed-version --mojo-platform-channel-handle=2320 /prefetch:2
  2⤵
  PID:3452
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2584,i,7603657028407703028,12460974702163622910,524288 --field-trial-handle=2324,i,5152689031329309691,8682409699565705484,262144 --variations-seed-version --mojo-platform-channel-handle=2612 /prefetch:8
  2⤵
  PID:1216
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3448,i,9457714273298638376,5230481686482082292,2097152 --field-trial-handle=2324,i,5152689031329309691,8682409699565705484,262144 --variations-seed-version --mojo-platform-channel-handle=3524 /prefetch:1
  2⤵
  PID:4448
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3452,i,9633819615968460025,17178416308072573172,2097152 --field-trial-handle=2324,i,5152689031329309691,8682409699565705484,262144 --variations-seed-version --mojo-platform-channel-handle=3528 /prefetch:1
  2⤵
  PID:3956
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4236,i,9282684122704686902,11290970899601471191,2097152 --field-trial-handle=2324,i,5152689031329309691,8682409699565705484,262144 --variations-seed-version --mojo-platform-channel-handle=4244 /prefetch:1
  2⤵
  PID:4596
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4268,i,4770390556293187130,3357005237375863093,2097152 --field-trial-handle=2324,i,5152689031329309691,8682409699565705484,262144 --variations-seed-version --mojo-platform-channel-handle=4264 /prefetch:2
  2⤵
  PID:560
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5140,i,3736785658438316751,14909237274687241780,524288 --field-trial-handle=2324,i,5152689031329309691,8682409699565705484,262144 --variations-seed-version --mojo-platform-channel-handle=5224 /prefetch:8
  2⤵
  PID:1492
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5132,i,17375787871895317655,12592252593265186504,524288 --field-trial-handle=2324,i,5152689031329309691,8682409699565705484,262144 --variations-seed-version --mojo-platform-channel-handle=5244 /prefetch:8
  2⤵
  PID:4648
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5836,i,314387383187175335,6302023823600549264,524288 --field-trial-handle=2324,i,5152689031329309691,8682409699565705484,262144 --variations-seed-version --mojo-platform-channel-handle=5856 /prefetch:8
  2⤵
  PID:3216
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5836,i,314387383187175335,6302023823600549264,524288 --field-trial-handle=2324,i,5152689031329309691,8682409699565705484,262144 --variations-seed-version --mojo-platform-channel-handle=5856 /prefetch:8
  2⤵
  PID:3912
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4316,i,11469840949258605470,6052404981060107388,524288 --field-trial-handle=2324,i,5152689031329309691,8682409699565705484,262144 --variations-seed-version --mojo-platform-channel-handle=5000 /prefetch:8
  2⤵
  PID:4692
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4300,i,11502389755032264546,6264652124613500811,524288 --field-trial-handle=2324,i,5152689031329309691,8682409699565705484,262144 --variations-seed-version --mojo-platform-channel-handle=6196 /prefetch:8
  2⤵
  PID:4312
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4492,i,17090105098978369435,1995424865901899985,524288 --field-trial-handle=2324,i,5152689031329309691,8682409699565705484,262144 --variations-seed-version --mojo-platform-channel-handle=4488 /prefetch:8
  2⤵
  PID:3316
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5408,i,7657037263261919926,2035970579901110203,524288 --field-trial-handle=2324,i,5152689031329309691,8682409699565705484,262144 --variations-seed-version --mojo-platform-channel-handle=5480 /prefetch:8
  2⤵
  PID:2844
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=748,i,18427941920682332670,1590830003001090296,524288 --field-trial-handle=2324,i,5152689031329309691,8682409699565705484,262144 --variations-seed-version --mojo-platform-channel-handle=2840 /prefetch:8
  2⤵
  PID:3928
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6444,i,5253640351885378677,14611208269272462521,262144 --field-trial-handle=2324,i,5152689031329309691,8682409699565705484,262144 --variations-seed-version --mojo-platform-channel-handle=5980 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3020

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:1636

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

blocklist

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\blocklist
Size 105KB
SHA256 eb3a2def9f4b6035941af73f13d4e0d6dabd1a81fd366178ace6a15412f5055f
MD5 892727a92ed5bb3d076e7c015f303461
SHA1 c06b37f3dbf604ea389be640479af6199627117c
SHA512 dd21d3eda95d2290b95a2fdb5d449733dc51ea5a65837f18375653e4a597ae34477d17b2c2d4b6dbb5ab366f9996fd2e1597cc7b409afac363ac88a6a4624414
SSDEEP 1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P7Q:fwUQC5VwBIiElEd2K57P7Q
TLSH
T1D6B3B931457E36BF26E93EE828CF1511B84F3912664895D4ABE1FE2C4845E68633CEF4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 ab98da7535c8de464335204ae97fd672936e639269325c3a388b3039d8396b83
MD5 1656a3560c7aeae221756f3891b89fd3
SHA1 e48441fe2b843ba3bd0bb7799c07b22a27db8eb7
SHA512 c06d7152d11e33601716d4c5c33c7373ac4e0c16571e80ac4a8ffb9cabb52fae51d4fe8d808fc75be943287b55a320e90a186d71a5f06e9db006f6ab89266400
TLSH
T1CFD09B307B597042D3074031E8074790169E84B5249B86066554410D7D5A485E3DF547
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 ec6419a915c6f94199df67c6cf1d67bc666c22ef160c8377d6792913a6518679
MD5 a8d0099e5966b86c13c6997282a63770
SHA1 df541b93a0caebe364906ec90c768bb625495f4c
SHA512 a2093c42c3f547b910f560ee7a58cb187cef96045e8e335276c7bde87fdc5e9894b670421e94170d0878e86a2bea8125d914e11181882004f966732f9670a693
TLSH
T135D09B303B597442D7074031E8064790169E84B5249BC7076554410D7D5B4C5E3DF547
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 b68c09f2d43efa4f1fc820a750295c4a987ce91f80ea4f63e939c207764a55f0
MD5 b013e1a6fad89e24e687ae23e7c451aa
SHA1 90a28ea986a03db25c63aa2225fa450959bfc9e5
SHA512 3e9d4d37da9b7938a1e4b7be0b21ade81c00bcdb835ac79e60cd0e020e4519873307c3599831f4c3d38518c5f4f1a9ab59b3db7f1526f433b6dfdd5a08f78564
TLSH
T1FE716EB0140EB8A9E35E0138ACC25E0CBF3140E9F817BF7D1A508F71551DB2882FAB26
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe58af56.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe58af56.TMP
Size 3KB
SHA256 b2109b76d895ec187a8626492a85ca49ef069763ef6148691f574e949e1662b9
MD5 9e6b4862cb1769c8b26229a738223104
SHA1 49e751a38bd8193c9e719a75fca120b21f48a931
SHA512 1ec8d488f85c248dacb6f127dfabc39d8fff67080d418a73c67a34036d7d86bd2bcb1c3349a62faf52c02b78408fcfe294086f85b380e88919462e283b71db80
TLSH
T1C6715FB0150EB899E35E01389CD25E0DBF3140E9F4177F7D1A508F75551D72981FAB26
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 949B
SHA256 e0cdd3bd2f2e1ed4ec32a7f30bcc5341a2bdd8c766f085841e5bf697a7de7838
MD5 a44ef656e25994a13275ec2d458eadbd
SHA1 63453d860fcda1931135bf77a864dafa8b4043ad
SHA512 246e717ea627f4327726ddcd258b060d587b888a01fb3708c295e351f6dab7dd1bd2a24152521d3872135167b8acaf4a79b64c0a0aa8103cc09b0f78a058e1de
TLSH
T103115BB3C3D5856E891116F06A24AE1BCE2D0505421C7D1589D4EF6B93E3069E00255B
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 f58eff95ddd7fea23481c2d65e01a2cd32b63ad4a020260749f1e2169fa09251
MD5 7fdbb3e5c2327cecd8aba855b3352fd8
SHA1 f921becb4ef0db5b5c1eba554a0f91952297775e
SHA512 ee3fbe5ae6f0019823742d6975d33ebd57da33a2e6ef223d64e676c1c33a78339f9ffca59cf41e3b489e509138fdfa027f6fefb8e8dbba9f5c0ae0f3f13fe32a
SSDEEP 192:sxZBRU/yM/jK1Ml8UQAkH/fnsX1nqIdpHTHW6+WNGYzj8atIg5LJ:sxZBy7qTH/fnsX1jzHbGif
TLSH
T19652C616AA349977CCDBD20AFA457B93D6F50473E6900E44A9FCDA0C04E6ADD2207C2F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 4f622f85d961500c9e89dd9e46154382090b3cabbc95cd979b9d38cd1fd2af68
MD5 a448af3f34f426e0e982eded11a77f3a
SHA1 4d3d1e7ce7dac8a9406dec4c4a422b977f32fd2f
SHA512 26f49a3997fa9618f66db14fed77ca1eb066919d353ab77503e75c331f2efe8f96dbc8b244e4e76eff663d9ba2de27b13cc9531681e025ccc3efa091281068a6
SSDEEP 192:sxZBRU/yM/jK1Ml8MkH/fnsmBnqIdpdTHW6+WNGYzQ5atIgrJ:sxZBy7MH/fnsmBj9HbGU9
TLSH
T1AE42D716AA349977CCDBD209FA457B53D6F50473E6900E44A9FCDA1C04E6AED2207C2F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 30KB
SHA256 d9137f0d99c48f42dd901851ea1bb1fd002fea2711329fb696c34bf4b6cd7177
MD5 c03405fab64dff7a9d4080572984c9bf
SHA1 d40ed3891f530cb4a443541205e8b93bdf8622fe
SHA512 4d34c0d0ee9f3e1ea8ea432cec621ca8df498486ae25d4583f5931458f26dd845f000945146ad3c64902b7758e0357c1e3cc88248cffb7047ecd9f1a193225cb
SSDEEP 768:OdW7kf0Wvqida8F1+UoAYDCx9Tuqh0VfUC9xbog/OVX5LlWYSj1roIyi9Y2:OdW7kf0Wvqidau1jaa5LA3jOj2
TLSH
T15AD2FA3B680CCB7E4F841E5CEC266F966ED801CB66988D5487FA884C03CB6EA51175DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 431abba9a9817f06e132a0ba36255eb42cdbffac274aa0eda5a6fbf2cfb2853e
MD5 a76f5d4c3e6db9f528fbd0ab4f82aee0
SHA1 f4000760834a426f778a0b4d61ace162f5a194f5
SHA512 bffad40c3744bb9501147d0e573e5773b0ea7a520df93e950adb746a01c25b8da90c55c72031938bc4fbe648d2737019943da0cd824e8b80f42dce41d7fe929b
SSDEEP 48:KfSVOyIQA2aQL9IZy2KYT73sbnR9JkZ9uPIufkKjB7pkPH08ORH5yljIBKIwEkRD:KIbCKcrUAKdamuj6KIwj6wKDSCg
TLSH
T1ECA14616323F4A563C7D2889B69585364F8231A37018B4EFBF78107A5E2AE610DFE4DD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

96a92ad9-f856-4889-b88a-f3935b0afafd.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\96a92ad9-f856-4889-b88a-f3935b0afafd.tmp
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 22KB
SHA256 b29752317720d6edd600a4d296602c617ea18bd96c6f85fde0e3b192c645b355
MD5 70215852b80391c938e0ae091421f4de
SHA1 0a8e0871bf9a25dce249b087679358870753e530
SHA512 a6e35d94add4e312efb336e42b73f1cb2586fd3eea2eb4279c012ce3bfd8169861a737dcdc0b565e83f7f9e8c26dbf7d034daafdbc56b4f3ab9b910e4b0ee863
SSDEEP 384:0iFiZcI2zsNy8TUNTUlIlT7nbt3nSd3UCEJrycOObjI9G6w7Ol:PFQGTwgFn5SYhyc29MOl
TLSH
T1F4A26D379C64C93BAEB6AA42F88A36179EF44137DBD4AA54F3D9AB0C01975DC0306C16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 9433f7a38a9cfad4de0d70227fca30df59bf931671f5d5cb0a4494e19b71c046
MD5 44281d6a8c2407a42d08259ead6c8f99
SHA1 eeabc540699053c2508ef32d672a42d8626cb71b
SHA512 8070afc3327738d1444d748c1b4834b7af20272d9ed0b219d59a71af1a5efc4b86a15b855a24357eee0162804ac9b9fde2b8dd2067e692c5927f75dc6f19a28c
SSDEEP 192:MONi64BAQmiUyu1yW5GBPKb++FdG2MaDvtWU6:MONi6eAt0WNd39VWU6
TLSH
T17E02E939AC786C7B9EA2AE45F48637175FD8113BEAC55B44EAE85B0C009774C2343C2B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 1b19d5a45ddf1393571135c283e463f4614b18a8d03230c9da69c1dc87e59cc6
MD5 f948805e38332b6f2839d372ccbc6cec
SHA1 1db38d7dc2ec2386a6a5f82c451b4df665bbbc0f
SHA512 6e01a15cb62fe389aa19ec0da6950f776ebe1d90c315ee3e336d194ca07405137bf9d02852970f8aa918ad6d45e3d23c7d711271b5b9da70b8952312e3905b0c
SSDEEP 192:WON764B2QmiUyRyV5GBPKb++FdG24RFC1SJrosWwqqkU6:WON76eStVNd3UCEJrBcU6
TLSH
T1E912F935AC64AC2B5EA2B541F48736179EE4413BEF856F44F6EC6B1C01EF69C2306C1A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 20KB
SHA256 91c7a3e0dfa900633651154f157e72a359336a1bdfb6a1e1ec0c7f2935149ec3
MD5 6a62b8b0a40ecff6717d5a411c443416
SHA1 68df01c2555f0b27d4862a0210ea94977d92dae7
SHA512 e09df06249b9d42e1a85b72b290a7dc9531d55b91472f47e875c46a6cbe1d5a54bb15c9dae5617375025d9f021245caf4e883d1122d2898b4d852e493fda4128
SSDEEP 384:8ZcIhsNqT7nbt3nSd3UCEJrPcOObjI9G6w7Ol:qhRn5SYhPc29MOl
TLSH
T1F9928E359C74993759A7A112F4863A175EF8913BE7C81F44F2EDEB0C05DA5AC1302C1A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 19KB
SHA256 43110d3cffff9586e09daa5bacdad5429efa6483ed00038b75b5626b35dce71a
MD5 72b04b4c4ea5cf563d45b4f53e30fcf3
SHA1 7bb33e7b77430f6e38b54bbaba3de495b76908bb
SHA512 9482ced9a616a451bfd803e6c1b4d4237e6308e4aed02ae2e8a7fddbbad5e3ae99177b03a4ea3d8e8fc8d9b3d0959232ca2512ff8a0c5c99e0b7657dabc094b9
SSDEEP 384:+ZcIhsNqS7nbt3nSd3UCEJrPcOObjI9G6w7Ol:8hQn5SYhPc29MOl
TLSH
T118927E359C74993759A7A112F4863A175EF8913BE7C81F44F1EDEB0C05DA5A81306C1A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

9d60845d-0d0c-4621-ae19-51434d6d3210.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\9d60845d-0d0c-4621-ae19-51434d6d3210.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 452e18d9142d6790b4f97bfcb26dc32ce4b35cbe275408b0346585ace4d42562
MD5 208ee22c81b493c602cc77a28a0fb6a3
SHA1 996e8b7e1f961adbed732ed537f292e3b9f1c8f1
SHA512 147bb24dc60100956833ade8a975bdfdeeb4af26901d4dd897fa10044a4ea6153b8f18f55045f75f5e8a826707b74529c235eaeb6f651322a5f472039e476091
TLSH
T1AC41F69CB6E91148B3B76E5AABF7A56E487E7D371F07949D00010D8F0A62B40C9A1737
MD5 SHA1 SHA512 TLSH

Submit Download

memory/3912-187-0x000001E513CF0000-0x000001E513E39000-memory.dmp

Download

memory/3912-186-0x000001E513CF0000-0x000001E513E39000-memory.dmp

Download