19d6110d531d66337890a1b851589a2850cb895fd071801b9ea804c1dec40682

Analysis

max time kernel
148s
max time network
136s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
06/08/2026, 02:58

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
view.html
Size 120KB
Sample260806-df9twasble
SHA256 19d6110d531d66337890a1b851589a2850cb895fd071801b9ea804c1dec40682
MD5 7e971be97f6d87a1f2ec608c2fd89308
SHA1 dac43d10caf9ce554e65b1499e34a97796beb550
SHA512 e67dafa61e1644963f4451ae833ad602c1322e45789a8d02247d40c21f90156750faa028c3b1d46c4b70f8d41aaaf0a70898cc28891c71f4189f62930493d508
SSDEEP 1536:4EVVOzNaKIdhVYKA4cUGeSxwzHX1TR9UnG91TR9UnGnEzQ3:S3q
TLSH
T188C3736202119CFDEFF744A3608A1D563E5C1137B3A25077F3D95EA96B934AB022837E
MD5 SHA1 SHA512 SSDEEP TLSH

Score

6^/10

discovery

Malware Config

Signatures

Contacts third-party web service commonly abused for C2 1 TTPs 7 IoCs

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Web Service

T1102

flow	ioc
49	drive.google.com
50	drive.google.com
63	drive.google.com
65	drive.google.com
66	drive.google.com
74	drive.google.com
116	drive.google.com

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
1372	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134304587102117193"	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1738198120-2966725515-3980530802-1000\{B824F9C4-C9B6-43DF-8526-29BE5A0B553A}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
5080	msedge.exe
5080	msedge.exe

Suspicious behavior: LoadsDriver 1 IoCs

pid
4

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
1208	msedge.exe
1208	msedge.exe
1208	msedge.exe
1208	msedge.exe
1208	msedge.exe
1208	msedge.exe

Suspicious use of FindShellTrayWindow 33 IoCs

pid	Process
1208	msedge.exe
1208	msedge.exe
1208	msedge.exe
1208	msedge.exe
1208	msedge.exe
1208	msedge.exe
1208	msedge.exe
1208	msedge.exe
1208	msedge.exe
1208	msedge.exe
1208	msedge.exe
1208	msedge.exe
1208	msedge.exe
1208	msedge.exe
1208	msedge.exe
1208	msedge.exe
1208	msedge.exe
1208	msedge.exe
1208	msedge.exe
1208	msedge.exe
1208	msedge.exe
1208	msedge.exe
1208	msedge.exe
1208	msedge.exe
1208	msedge.exe
1208	msedge.exe
1208	msedge.exe
1208	msedge.exe
1208	msedge.exe
1208	msedge.exe
1208	msedge.exe
1208	msedge.exe
1208	msedge.exe

Suspicious use of SendNotifyMessage 16 IoCs

pid	Process
1208	msedge.exe
1208	msedge.exe
1208	msedge.exe
1208	msedge.exe
1208	msedge.exe
1208	msedge.exe
1208	msedge.exe
1208	msedge.exe
1208	msedge.exe
1208	msedge.exe
1208	msedge.exe
1208	msedge.exe
1208	msedge.exe
1208	msedge.exe
1208	msedge.exe
1208	msedge.exe

Suspicious use of WriteProcessMemory 33 IoCs

description	pid	Process	procid_target
PID 1208 wrote to memory of 3452	1208	msedge.exe	88
PID 1208 wrote to memory of 1372	1208	msedge.exe	90
PID 1208 wrote to memory of 4072	1208	msedge.exe	91
PID 1208 wrote to memory of 4072	1208	msedge.exe	91
PID 1208 wrote to memory of 4072	1208	msedge.exe	91
PID 1208 wrote to memory of 3640	1208	msedge.exe	92
PID 1208 wrote to memory of 3640	1208	msedge.exe	92
PID 1208 wrote to memory of 2704	1208	msedge.exe	94
PID 1208 wrote to memory of 2704	1208	msedge.exe	94
PID 1208 wrote to memory of 2704	1208	msedge.exe	94
PID 1208 wrote to memory of 4784	1208	msedge.exe	95
PID 1208 wrote to memory of 4784	1208	msedge.exe	95
PID 1208 wrote to memory of 4784	1208	msedge.exe	95
PID 1208 wrote to memory of 124	1208	msedge.exe	96
PID 1208 wrote to memory of 124	1208	msedge.exe	96
PID 1208 wrote to memory of 124	1208	msedge.exe	96
PID 1208 wrote to memory of 252	1208	msedge.exe	97
PID 1208 wrote to memory of 252	1208	msedge.exe	97
PID 1208 wrote to memory of 252	1208	msedge.exe	97
PID 1208 wrote to memory of 1548	1208	msedge.exe	99
PID 1208 wrote to memory of 1732	1208	msedge.exe	100
PID 1208 wrote to memory of 1548	1208	msedge.exe	99
PID 1208 wrote to memory of 1732	1208	msedge.exe	100
PID 1208 wrote to memory of 5976	1208	msedge.exe	102
PID 1208 wrote to memory of 1484	1208	msedge.exe	105
PID 1208 wrote to memory of 1484	1208	msedge.exe	105
PID 1208 wrote to memory of 1484	1208	msedge.exe	105
PID 1208 wrote to memory of 1528	1208	msedge.exe	107
PID 1208 wrote to memory of 2004	1208	msedge.exe	108
PID 1208 wrote to memory of 3540	1208	msedge.exe	109
PID 1208 wrote to memory of 5572	1208	msedge.exe	110
PID 1208 wrote to memory of 5572	1208	msedge.exe	110
PID 1208 wrote to memory of 5080	1208	msedge.exe	112

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument C:\Users\Admin\AppData\Local\Temp\view.html
1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1208
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x260,0x264,0x268,0x25c,0x288,0x7ffd1ae6c188,0x7ffd1ae6c194,0x7ffd1ae6c1a0
  2⤵
  PID:3452
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1808,i,3126237017791628092,9679326781601645305,524288 --field-trial-handle=2636,i,16915896263614819064,10561618506126294663,262144 --variations-seed-version --mojo-platform-channel-handle=2708 /prefetch:11
  2⤵
  - System Time Discovery
  PID:1372
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1612,i,3314850201122840137,9268062075331327462,262144 --field-trial-handle=2636,i,16915896263614819064,10561618506126294663,262144 --variations-seed-version --mojo-platform-channel-handle=2616 /prefetch:2
  2⤵
  PID:4072
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2200,i,9877397731322472823,13984135457574831065,524288 --field-trial-handle=2636,i,16915896263614819064,10561618506126294663,262144 --variations-seed-version --mojo-platform-channel-handle=2784 /prefetch:13
  2⤵
  PID:3640
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3596,i,2352076171653753763,14119180426329847924,2097152 --field-trial-handle=2636,i,16915896263614819064,10561618506126294663,262144 --variations-seed-version --mojo-platform-channel-handle=3676 /prefetch:1
  2⤵
  PID:2704
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3604,i,8891442383181286964,17072156030464666645,2097152 --field-trial-handle=2636,i,16915896263614819064,10561618506126294663,262144 --variations-seed-version --mojo-platform-channel-handle=3684 /prefetch:1
  2⤵
  PID:4784
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4328,i,9060293507326945668,16201663313743110903,2097152 --field-trial-handle=2636,i,16915896263614819064,10561618506126294663,262144 --variations-seed-version --mojo-platform-channel-handle=4344 /prefetch:1
  2⤵
  PID:124
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4364,i,6992333789036215414,2608893607660284598,2097152 --field-trial-handle=2636,i,16915896263614819064,10561618506126294663,262144 --variations-seed-version --mojo-platform-channel-handle=4320 /prefetch:9
  2⤵
  PID:252
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5368,i,9007784248403474539,17076659412737010235,524288 --field-trial-handle=2636,i,16915896263614819064,10561618506126294663,262144 --variations-seed-version --mojo-platform-channel-handle=5436 /prefetch:14
  2⤵
  PID:1548
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5372,i,2820210543070254816,14565171524828067854,524288 --field-trial-handle=2636,i,16915896263614819064,10561618506126294663,262144 --variations-seed-version --mojo-platform-channel-handle=5444 /prefetch:14
  2⤵
  PID:1732
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6076,i,4751666374743495577,7358356608775147414,524288 --field-trial-handle=2636,i,16915896263614819064,10561618506126294663,262144 --variations-seed-version --mojo-platform-channel-handle=6112 /prefetch:14
  2⤵
  PID:4960
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6076,i,4751666374743495577,7358356608775147414,524288 --field-trial-handle=2636,i,16915896263614819064,10561618506126294663,262144 --variations-seed-version --mojo-platform-channel-handle=6112 /prefetch:14
  2⤵
  PID:5976
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --always-read-main-dll --metrics-shmem-handle=4540,i,12754219121050826931,17179080996767600071,2097152 --field-trial-handle=2636,i,16915896263614819064,10561618506126294663,262144 --variations-seed-version --mojo-platform-channel-handle=5168 /prefetch:1
  2⤵
  PID:1484
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6588,i,9254165932598230073,10353859210644063023,524288 --field-trial-handle=2636,i,16915896263614819064,10561618506126294663,262144 --variations-seed-version --mojo-platform-channel-handle=6552 /prefetch:14
  2⤵
  PID:1528
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6192,i,5240902015219888735,16081666591536565009,524288 --field-trial-handle=2636,i,16915896263614819064,10561618506126294663,262144 --variations-seed-version --mojo-platform-channel-handle=6548 /prefetch:14
  2⤵
  PID:2004
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6576,i,4749812713374708312,16511103433413056258,524288 --field-trial-handle=2636,i,16915896263614819064,10561618506126294663,262144 --variations-seed-version --mojo-platform-channel-handle=6636 /prefetch:14
  2⤵
  PID:3540
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5660,i,3323996741076058585,9091774854574795738,524288 --field-trial-handle=2636,i,16915896263614819064,10561618506126294663,262144 --variations-seed-version --mojo-platform-channel-handle=5452 /prefetch:14
  2⤵
  PID:5572
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6068,i,16932496163456302937,6101477494304121296,262144 --field-trial-handle=2636,i,16915896263614819064,10561618506126294663,262144 --variations-seed-version --mojo-platform-channel-handle=6052 /prefetch:10
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5080

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:5612

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:4480

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 ac1b1f93ff87eb876027f4166d705375c0f5d3d22dcb03f6a66f6100e88dd10f
MD5 b99f03c5cfe71b03836f8b5fcf09425b
SHA1 8a5078499c0b5ea40183efb77f9c1028c196409c
SHA512 6b9feec4ead7bf05f67d0d480907e21a3b770d8d12dedd2b0d785904186eac7448583e61abacb23582948de55c8ea2043bfd6908efd7faecdd82cee91404cfe6
TLSH
T16DD02BE037909D18C440353163D0122091006C30880923090100A02C8D3E2C3054F0BE
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 c95a47aec5edba88214fad580cb869417b6620a91d8ee97e2d0b7801d3372be5
MD5 aad5f2ca0dd16bb2ea6c7757ea569c50
SHA1 5228b0b132542be004ea1bb32f3748964d065af5
SHA512 9d59c0291d741bd9d6cf50c22972d4baef00e7c1a48d6a3311a6cc82c04ceeba6e2be9458334cb954878915cc9eb91a8fd8bc4a47c966d57a2a05d6ee8211640
TLSH
T1D4D09BE177A19D18C545353567D1522591416D31451927194241E13D9D7E2C3455F0AA
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 6839afa4d49db5391becb152e3bd0afc8c556a9878c101de7c38f73b274b0dc6
MD5 820cae4eb9db8694e55541c870b5b47d
SHA1 5cd3662ce47dbc4d2331136bffbdc8efddfb2abf
SHA512 bc48c5a478057be1b5b5124050c58312818c045cf2ee5da8bfca218b2b2961f3b680273ba9bd00676e9ac8ab716e33ccb8ef235617d06bb4b99582cc81f48c1f
TLSH
T1BF615F9B935109CEDB248EB852D4F44E3BF9E47D8717AE1460E76DB0940AFD4E2E002B
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 76a054f3b6cff4d3cc319634d6a5d1c1ba9614adffae6f76ba7bef9b5597cfb5
MD5 671c11646b43b182254f8a7d7ba5d4bf
SHA1 f8ba3a4eda5f7b628e96cb0d206bd337f60e17a7
SHA512 525bfb0eb2fed97e982350c50e18a41c597f25bd8a852e82a25f8e34711103f689937a4254dea1e1569adeaccddb71b564a37bb94b39af33d548e362833696f0
TLSH
T12961309B935109DEDB258E7852D0F48E3BF8E47D8717AE1461E76DB0940AFC4D2D006B
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe595e91.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe595e91.TMP
Size 3KB
SHA256 fe9781527cb7a5bd20c248534afaae2769489bb9f1416bd99a1b4cba6651694b
MD5 288a0d11c41d5c5f918d02b7e8fc410d
SHA1 0ca29c7f4548480d12c20007d90d59d75a9cb69e
SHA512 d4c46a858091e4d3aebba7c28806cdb01e7c35d1751294d8fc152c62931ef0bc4b9bdeeceb890cb0cbdec77c77034537fa44617cc003e99eb03601bfa5b4170c
TLSH
T16761519B935109CEDB248E7852E0F44E3BF8E47D8717AE1460E76DB0940AFC4E2E002B
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 6KB
SHA256 e500da44e39d787747e745d3056067c848da75f93de518cc0dfdefaf00aa6128
MD5 8bf1e25d649cf3c702ee9fc61a25083f
SHA1 e3b884be1b801743457be2960b35d3eddb4285c4
SHA512 38d089fd879986115e059e01648099475f836e3824aac662d82e17b9b83b4583cd4519e3b420c5f52ce9b0b33a5a423c99b0d647745dbb76a8884877deb46645
SSDEEP 192:Dw9l6345NPMXjfZivja4ALo9dqv9OdTqa5Ws:Dw9l6o5NPMXjfZivjrALo9Yv9OdTqa51
TLSH
T16CD19DF7C6D8877E880152F09B296D2ACD2D155A423C3C56C8E8AF5F67E2471D2026AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 6KB
SHA256 4d85a91cb4198b89d2f103f5de14ddda2a1efd4d04ceab274338362069125c11
MD5 3973aeea14d63e0dc16f8ab30909b695
SHA1 83cffaa34bcc6cafeed43179f07c7d3d657cc7ac
SHA512 00c26c922fe5b7e1b282e08c1890f557279020e2ebd3d09a0147bd62e1c45c8a753d4a37bf86e62336aa4340ecc830f18c5fef04fbad5b784b3838dcf09152ae
SSDEEP 192:Dw9l6345NPMDjjfZivn4ALo9dqv9OdTGXQ+Lx:Dw9l6o5NPMDjjfZiv4ALo9Yv9OdTGXQE
TLSH
T1C2D19CF7C6D8877E880152F09B256D2ACD2D195A423C3C5688E8AF5F63E2471D2026AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 733520f4175b2278c7b66bef5039cba82f19a9447b27670c91a002295dab6553
MD5 19f52049c8892f64beb28d6432b4d639
SHA1 f158c1a8c77906127497c25ee763ee263d403f76
SHA512 ee49410914f8a1d83295bef1cbd958cf6164d5069c1e205cdaafe3ff7092cf7f4c6e0bad471cd2ad055fa47c21d53ccddfa86e650438f81502a05e02208d8a96
SSDEEP 192:sxRdR9b3/f9se3wGwzoA8p4M/g6+WNIYoqCYvG0IgDLJ:sxRdH3/f9se3pp9/5Ip+x
TLSH
T10E32C6156928AD3B8CC6E21DBB65BF53D2F9517261D12E48F6FC970C00EBADD220780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 08be3a0bea8357a2466c5ca4d987de73a8a644f09df04fe0e74835296ec56eee
MD5 32ae86f424a6cf0df98079fcf8ce7bee
SHA1 1095cdc0ac7fa2735c7cae5ac894cf9b6067f09e
SHA512 baeda1ebfe4dad6b84609035cdefb5b7503c64f397518c4388668b3b55499c7e33b127f423793e98395877220339d66ae233549bbdac283d14d38c20f7ee6ebe
SSDEEP 192:sxR+R9b3/f9sLowGwzoA8p4M/g6+WNIYoXCYvG0IgIJ:sxR+H3/f9sLopp9/5Iy+s
TLSH
T19832C7156928A93B8CC7E21DFB65BF53D2F9113261D02E48F6FC970C00EAADD220780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 c11f9c0574d361623e42c8e72a1c16e6e4a3c50521ac9b646e277342a17e4709
MD5 132758045ee1505ec4d4b3d4758652e1
SHA1 d5dc9a1442ad0d3cd37a66777c0d14650ef7afab
SHA512 1d5124efe25bac0bb6e92f0b859002eec6643a0594aaef9242a15c1333553f7473573dd4a882c2b8edf6be9dbd041d5ffd45c8111018d3fc4d441ff34f8c2e8b
SSDEEP 192:sxRdR9b3/f9seowGwzoA8p4M/g6+WNIYoXCYvG0IgDFJ:sxRdH3/f9seopp9/5Iy+z
TLSH
T18B32B6156A28A97B8CC6D21DBB65BF53D2F9117261D12E48E6FC971C00EA6DD220780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 23KB
SHA256 19b9f775e2aafaa9edba4f10853433c448c0b37b2226f0bd599ff5579e5dc108
MD5 496d05ad0c2be81db9942e0a84154ec7
SHA1 812a315a0f6c866a31715ce8d43e4a521654a38f
SHA512 7c568814aad3a96ae42ae14880f599b2971799e6f68d21c886ef4002be5371619f3ad08ffad05180b28ec0c8c7876b6d3729791f4991055738070fdf86cbd6a5
SSDEEP 384:jzK6H0dfCtgsqFf02KhOObJ+UoAYDCx9TuqZz0VfUCh7xbog/OVvf9uaRXEro98+:j26H0RWgs2f028F1+UoAYDCx9Tuqh0VS
TLSH
T1DEB2EB2B640DCBBE5F800A9DDC196FDB6D9802C79B588D4047FE994C03C7BEA911A4DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 41KB
SHA256 fd6986f85b269beb1462e9c9b5b6dae8e6ccf7d35d53f2d81b71d9f8d3718b8b
MD5 88d4a87144e07d0d03c2484576267e32
SHA1 15101bf3e6de12578043e6f2ff1a332b5ea16088
SHA512 a14503ebe38860fa04e09819f38373df265505ce79cf1e2a417b51bd655791b75f7dd8036f031fecd3fbb6102d7b43ca3f57e30c275ee2a573aa11baf5093af4
SSDEEP 768:grv+4UNbd93+77/TBOWsLQjtvONXyer1IRCzni9X2ewBKZOIQ:gbsbX3+HQ8SIqnc2evZ4
TLSH
T18013BD35E468AE738CE2A2D6B5077243BEB82153D5C507A0DAEE2F5D019B59E230FD13
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 41KB
SHA256 6ac62d5f4cccf42046188a4b8e4750ba9e47286b24ee3cf4c35cad6b7ae1adbe
MD5 9f42758eb8aac8efb8aaf8c6cc1d9250
SHA1 45edc0a9fa8f39d8d294c020f26ce0656a8160ae
SHA512 6b27f0c23583ff40f8d432953c7b70e8d76dc47ec77cb686c56b9edd0f4accf1b9ae1fe3f6b679be4e7ac799b5cdd74977554d3bd8832c98a001a62678242bd4
SSDEEP 768:prv+4UNbd43+77/TBOWsLQjtgONXyer1IRCzni9X2ewBKZOIQ:pbsbC3+HQnSIqnc2evZ4
TLSH
T10213BE35A468AE738CE2A2D6B5077243BFB82057D5C507A0DAEE2F5D019B59E230FD13
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 41KB
SHA256 a5fd646f17d56d67326a10297f0f2ce534868db74143824d287d2e26be043b3f
MD5 e86edaa2561c740335899ccc0f9a935a
SHA1 e041b22cc77b19b88fe5da6df206b8d2b0064458
SHA512 b3f073b09c58e0031c0bcc567ae5cc509d4ada2eaa22fd3ccb5a9300612c96dae6b786a15fae98a988d2cc4191944cbf475660c3b6bf0454b1978bd5244ce14f
SSDEEP 768:Srv+4UNbd43TNS7/TBOWsLQjtmONXyer1IRCzni9XeVH1SK3:SbsbC3TNSQrSIqncEH1R
TLSH
T1BC13BE35A4A89E374CE2A3D6B04772437FB86057C6C407A0E9EA2F5E069B59E130F917
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 39824d013a03f50b0f6a52a07401d80bef6a5b95693bd41abb3e383cc0687784
MD5 26869741c557b940baf717c5e7092c38
SHA1 23ce2e7c88778dbc7710347a347c969a54ab115a
SHA512 5989e16b2f6128b9c8c4f719091a87ee92b154fc9d8ea0ac0c1e5f97b417b0fcce5e489820940da91f6d56df394d0ac0af170ae067f57753b7cad272aa31fd96
SSDEEP 768:hrv+4UNbdz3Pz/TBOWsLpONXyer1IRCzniBreVH1SK7:hbsbV37QpSIqnMEH1l
TLSH
T13603BE36E4A89E378CE2A3C5B14772037FB86057D68407A0D9DE1F4E069B59D130B957
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\metadata.json
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download