fd237c710bdeaf95a9b520f86aea1a0b471d7aaa671b383528522417de8f2904

Analysis

max time kernel
899s
max time network
895s
platform
windows10-ltsc_2021_x64
resource
win10ltsc2021-20260513-en
resource tags

arch:x64arch:x86image:win10ltsc2021-20260513-enlocale:en-usos:windows10-ltsc_2021-x64systemwindows
submitted
08/08/2026, 02:37

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
sample.html
Size 7KB
Sample260808-c4kdfsydmg
SHA256 fd237c710bdeaf95a9b520f86aea1a0b471d7aaa671b383528522417de8f2904
MD5 fa235717ca0ca976035d0664362f95a0
SHA1 58715c5db1b9f69dff3bafcf3e85a3cc0a1fc6b8
SHA512 224936d263986be68326f3855a9e3e587b13e9b380872d55bbf5222e9c700fee70ab0a083c6a4ec49ef1615af62b7ba98685be5fa1e86e92227661b27dfca6b5
SSDEEP 192:XctFWXpqD8yhu1fUFOpWUR8I5eHxw4ctBE:qQXUfhu1oO8tI5O5cE
TLSH
T17DE14A185984362B44738B784BB32148EF61B0A79523E1A23ADC65970FB6350CED33CD
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
2260	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134306302976164205"	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2684263265-1628758615-802431902-1000\{0CEE0263-4969-47C6-8E8F-E026218CD51E}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4136	msedge.exe
4136	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 3 IoCs

pid	Process
3884	msedge.exe
3884	msedge.exe
3884	msedge.exe

Suspicious use of FindShellTrayWindow 33 IoCs

pid	Process
3884	msedge.exe
3884	msedge.exe
3884	msedge.exe
3884	msedge.exe
3884	msedge.exe
3884	msedge.exe
3884	msedge.exe
3884	msedge.exe
3884	msedge.exe
3884	msedge.exe
3884	msedge.exe
3884	msedge.exe
3884	msedge.exe
3884	msedge.exe
3884	msedge.exe
3884	msedge.exe
3884	msedge.exe
3884	msedge.exe
3884	msedge.exe
3884	msedge.exe
3884	msedge.exe
3884	msedge.exe
3884	msedge.exe
3884	msedge.exe
3884	msedge.exe
3884	msedge.exe
3884	msedge.exe
3884	msedge.exe
3884	msedge.exe
3884	msedge.exe
3884	msedge.exe
3884	msedge.exe
3884	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
3884	msedge.exe
3884	msedge.exe
3884	msedge.exe
3884	msedge.exe
3884	msedge.exe
3884	msedge.exe
3884	msedge.exe
3884	msedge.exe
3884	msedge.exe
3884	msedge.exe
3884	msedge.exe
3884	msedge.exe
3884	msedge.exe
3884	msedge.exe
3884	msedge.exe
3884	msedge.exe
3884	msedge.exe
3884	msedge.exe
3884	msedge.exe
3884	msedge.exe
3884	msedge.exe
3884	msedge.exe
3884	msedge.exe
3884	msedge.exe
3884	msedge.exe
3884	msedge.exe
3884	msedge.exe
3884	msedge.exe
3884	msedge.exe
3884	msedge.exe
3884	msedge.exe
3884	msedge.exe

Suspicious use of WriteProcessMemory 30 IoCs

description	pid	Process	procid_target
PID 3884 wrote to memory of 5484	3884	msedge.exe	82
PID 3884 wrote to memory of 2260	3884	msedge.exe	83
PID 3884 wrote to memory of 3596	3884	msedge.exe	84
PID 3884 wrote to memory of 3596	3884	msedge.exe	84
PID 3884 wrote to memory of 3596	3884	msedge.exe	84
PID 3884 wrote to memory of 784	3884	msedge.exe	85
PID 3884 wrote to memory of 784	3884	msedge.exe	85
PID 3884 wrote to memory of 3928	3884	msedge.exe	87
PID 3884 wrote to memory of 1984	3884	msedge.exe	88
PID 3884 wrote to memory of 3928	3884	msedge.exe	87
PID 3884 wrote to memory of 3928	3884	msedge.exe	87
PID 3884 wrote to memory of 1984	3884	msedge.exe	88
PID 3884 wrote to memory of 1984	3884	msedge.exe	88
PID 3884 wrote to memory of 4020	3884	msedge.exe	94
PID 3884 wrote to memory of 4020	3884	msedge.exe	94
PID 3884 wrote to memory of 2212	3884	msedge.exe	95
PID 3884 wrote to memory of 2212	3884	msedge.exe	95
PID 3884 wrote to memory of 1772	3884	msedge.exe	98
PID 3884 wrote to memory of 2912	3884	msedge.exe	106
PID 3884 wrote to memory of 6024	3884	msedge.exe	107
PID 3884 wrote to memory of 4188	3884	msedge.exe	108
PID 3884 wrote to memory of 5880	3884	msedge.exe	109
PID 3884 wrote to memory of 5880	3884	msedge.exe	109
PID 3884 wrote to memory of 4136	3884	msedge.exe	110
PID 3884 wrote to memory of 1936	3884	msedge.exe	111
PID 3884 wrote to memory of 1936	3884	msedge.exe	111
PID 3884 wrote to memory of 5328	3884	msedge.exe	112
PID 3884 wrote to memory of 5328	3884	msedge.exe	112
PID 3884 wrote to memory of 2836	3884	msedge.exe	113
PID 3884 wrote to memory of 2836	3884	msedge.exe	113

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument C:\Users\Admin\AppData\Local\Temp\sample.html
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3884
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x260,0x264,0x268,0x25c,0x28c,0x7ff93c20c188,0x7ff93c20c194,0x7ff93c20c1a0
  2⤵
  PID:5484
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1956,i,7089217003296450332,7865792548781580775,524288 --field-trial-handle=2248,i,3401785590948288662,17475293068104386578,262144 --variations-seed-version --mojo-platform-channel-handle=2276 /prefetch:3
  2⤵
  - System Time Discovery
  PID:2260
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1668,i,2268049376554737402,11820528403373255790,262144 --field-trial-handle=2248,i,3401785590948288662,17475293068104386578,262144 --variations-seed-version --mojo-platform-channel-handle=2244 /prefetch:2
  2⤵
  PID:3596
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2584,i,5709003533489141176,17800918083835828700,524288 --field-trial-handle=2248,i,3401785590948288662,17475293068104386578,262144 --variations-seed-version --mojo-platform-channel-handle=2604 /prefetch:8
  2⤵
  PID:784
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3488,i,6395979650801441932,661709565790898088,2097152 --field-trial-handle=2248,i,3401785590948288662,17475293068104386578,262144 --variations-seed-version --mojo-platform-channel-handle=3500 /prefetch:1
  2⤵
  PID:3928
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3496,i,2854002436271606712,6226594518186663468,2097152 --field-trial-handle=2248,i,3401785590948288662,17475293068104386578,262144 --variations-seed-version --mojo-platform-channel-handle=3516 /prefetch:1
  2⤵
  PID:1984
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5076,i,4565757964557036238,7373578196665712310,524288 --field-trial-handle=2248,i,3401785590948288662,17475293068104386578,262144 --variations-seed-version --mojo-platform-channel-handle=5100 /prefetch:8
  2⤵
  PID:4020
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5080,i,3622502890468116087,7337876635037433225,524288 --field-trial-handle=2248,i,3401785590948288662,17475293068104386578,262144 --variations-seed-version --mojo-platform-channel-handle=5136 /prefetch:8
  2⤵
  PID:2212
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5628,i,1994600167801251401,710622129687813124,524288 --field-trial-handle=2248,i,3401785590948288662,17475293068104386578,262144 --variations-seed-version --mojo-platform-channel-handle=5644 /prefetch:8
  2⤵
  PID:4888
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5628,i,1994600167801251401,710622129687813124,524288 --field-trial-handle=2248,i,3401785590948288662,17475293068104386578,262144 --variations-seed-version --mojo-platform-channel-handle=5644 /prefetch:8
  2⤵
  PID:1772
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=600,i,15725448275857544716,6827465506895476837,524288 --field-trial-handle=2248,i,3401785590948288662,17475293068104386578,262144 --variations-seed-version --mojo-platform-channel-handle=5988 /prefetch:8
  2⤵
  PID:2912
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5700,i,7773098774131297185,760596679260190717,524288 --field-trial-handle=2248,i,3401785590948288662,17475293068104386578,262144 --variations-seed-version --mojo-platform-channel-handle=5644 /prefetch:8
  2⤵
  PID:6024
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5640,i,17834752317766819751,10026221246902537635,524288 --field-trial-handle=2248,i,3401785590948288662,17475293068104386578,262144 --variations-seed-version --mojo-platform-channel-handle=6076 /prefetch:8
  2⤵
  PID:4188
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2992,i,13785804631640591555,17765924254758191976,524288 --field-trial-handle=2248,i,3401785590948288662,17475293068104386578,262144 --variations-seed-version --mojo-platform-channel-handle=2152 /prefetch:8
  2⤵
  PID:5880
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.4355 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=5964,i,14884777132120913877,7449861963116073227,262144 --field-trial-handle=2248,i,3401785590948288662,17475293068104386578,262144 --variations-seed-version --mojo-platform-channel-handle=5944 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4136
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5504,i,8652032864658916231,5809506358305752434,524288 --field-trial-handle=2248,i,3401785590948288662,17475293068104386578,262144 --variations-seed-version --mojo-platform-channel-handle=5828 /prefetch:8
  2⤵
  PID:1936
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2160,i,7208374588355104373,9643642753644999275,524288 --field-trial-handle=2248,i,3401785590948288662,17475293068104386578,262144 --variations-seed-version --mojo-platform-channel-handle=4704 /prefetch:8
  2⤵
  PID:5328
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3212,i,15522928921334980011,7801722478731344777,524288 --field-trial-handle=2248,i,3401785590948288662,17475293068104386578,262144 --variations-seed-version --mojo-platform-channel-handle=4700 /prefetch:8
  2⤵
  PID:2836

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:5548

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:2408

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 524ae55519907b3ab75a388a7d8adb5b3e5bdde0aabefe20ce772a09ea687d5b
MD5 f6eb566f9aba7efdbfb5c795bd65c547
SHA1 0ce2d6e7d9e58cb863af3f628d52cd4dd694f6fa
SHA512 2b08121677adac5c93abf00acc6bfcb28d8a72bca78fdef9052724d4f592d583e28680a2ae9a96d1bb7c0a432f05c206ebc2ec8238e6cabafaf5ae8743b7260b
TLSH
T19CD0C023360D3004E3494231D002C3042311447810078301F330D88C89241C4D2930C3
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 2aafce1c037be05e4c7ebafed37cf7282f3b61da9ab3f68cb43c724193f2a4ab
MD5 1a34bb39930694ea7604881fe671a327
SHA1 984165fe8abd42a03cd121d90e23865b1b24606e
SHA512 c9c7ad13bf7dcca0de7ae942e5c953da986e722b63c12f23dbc118dda97022414b13f1027b23b74906f10699650754782ea88b9d17b1c4e8aad63cf538d45022
TLSH
T147D0C0233A093004E3454231D042C3043321407810078301F330D88C89641C4D2930C3
MD5 SHA1 SHA512 TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 352B
SHA256 88d04437b89124d7f53c5826ba2fbadddb690b5236b252520d7e78c9992d4b6d
MD5 46b47392875caa8511cdd15509ee1c2d
SHA1 c17e3d4b17a0121adda4a0148c8bf6ec1f3d8044
SHA512 949541f18d78f81fbed0116c0a46ca8badca95f9bf1a374f94b66f6a3567c8233a8ba3126b53bbe26eb95f1a7c5ccfe39e5e744eb9a7f5aa303ccc952aa3e426
TLSH
T150E0D85433E0E1564903A94FB4F4921D81D17655DD4BF55A3325784E5D408049593CA6
MD5 SHA1 SHA512 TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 331B
SHA256 ad3d69aafff117e7bb874e191d61512ed2d85dd86460363edb47a27065f6da9b
MD5 ccb6fb0807107bbcfa842400aa905718
SHA1 1394805c8b4d43e1ae268fdccb9c553e3f3b0afa
SHA512 0d3b3e58b9a35cfc4beb6a7cf8629463ab89981a340d1e86f4e6708b2e4d4efa120aeeabff0c1a655df398708ec5b7f7f86c7518443a64ee25d963d39acd7ac8
TLSH
T101E0204415C8C2DD5700648FB254870CC1C0360EAED5D9471704B9C93945040FD96E60
MD5 SHA1 SHA512 TLSH

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\MANIFEST-000001
Size 268B
SHA256 b9d76e8859f80d72cc53eb6013de2642194153f736a057aba6ddec1c4f9b086b
MD5 8c3defc2923df9724b0c333ece116062
SHA1 1b5d2b714b9c03a368e8e9b7a9d93e60a96121fc
SHA512 55fd524bcad4d221c6b4064b7d1cb46ae4966a2176f30526a9525609e90d4453e8d77a6a064f1d78fc5d879874ef6f43fb119875deea457c2bbea9dbee0707cb
TLSH
T17FD05B9AFDEC9E5ED7F44ABD57F5B8040A480292541B9B135034BEC134956F41F65034
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BrowsingTopicsState
Size 414B
SHA256 8fe3bf8c5d8555b97f72b8a1096d4f7846305d1b878e963532e0cb43316e7ec8
MD5 0d5f83f66c25f862103ec353102cb4b5
SHA1 42592a4852375d996eccad1d6d56967ed74102e7
SHA512 273272d270fda12cfac8df6c6799cd90db6f7b88a91fd2b7c45885b22a1c1ea72940896dd450fe4ed95af5f92cbba41a45c38e4ec75ca8ed4b79c6b1773b2866
TLSH
T110E02BE5CD61EC371CFD071850640789E71003572B50555F3A3C920CCFB063B52CA96C
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 1KB
SHA256 c24cd9096f0f05b7984532ef8b821ffe2c2f67ec817c376add8a210c32f1576f
MD5 7317ccc21820ba5313893dbe31a442eb
SHA1 8f1c13d0f30e5d41082366e5768f1ffdaec1888b
SHA512 23a4c2e39a696b816104bb49e1b842a0965588c2c41398cab2d7ea993740ce7eaab22ef55001944090a56adaf98785aba184e37bb9f7b4b90fb7f9ec21170afd
TLSH
T18631E2F783F4856EC91196F0AA18BE1FCE1D0515432C7DA9C5E4AE1B93E3471E041A5F
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 1KB
SHA256 8093929d57da18894ce03867f008117ca8833359949bf3182fdb93d8a1b0e314
MD5 afb736195a987b3a0c00aa9edc216a5e
SHA1 ac006c28215fc5e7b22c4665730dfa7b1400fab9
SHA512 e1e7eefab2e955430c42090b83344301c9a1baf6d22ea8d25d8ffe06063417cde80d6f0b393e5ae8309457ff7da1c552ca8ed9b134f9faff3611714d651ea14e
TLSH
T1C231B2F783F4856E8A1195F0AA18BE1FCE1D0511432C7DA985F4AE5B93E3471E041A5F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 15KB
SHA256 147441eb2abeb14eba266dcd29a72a88cd27a60e806e08fc27839184d3d13d80
MD5 78cd273ed97e08f85c99ce2914967f03
SHA1 d75fe71acbf97c40ed93210043e28902e73a7037
SHA512 627c89271d5cd0e205f26051fe31dee81747ba305dbe16acb24e3aaf70144906e5466a02aa15457826cbe3a598dae6ee8d6d35c3680c1c13783afce1cbf9d012
SSDEEP 192:sxZnRByMqZjK1Ml8UQakp/fksUJr8Z5z/XzodpH6HW6+WNGYQsEwc02Ig5yiJ:sxZn2qpp/fksCrC5r8aHbGucXc+
TLSH
T1716207156E3899779CDBD209FA55BF93D7F9052391804E48A9FC8A0C04E7AEC221382F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 efcce8273cef08abc1041e533aba567b14c80e7eb7ad2b7df77d1914c11cd3b2
MD5 6f02d4a96ce479e8aa3a295779c3e2f2
SHA1 18c658f5a05fc6bfc468502f12bf7ed4b99b26ed
SHA512 1cef492360dc0409dc807007dcd9c8eee4d504cfc8803e0258b25459734148e12aaafce089bdc79d5881f8170728e2455e3551d4e64dae3543b9ba17289dcb62
SSDEEP 192:sxZnRByMqZjK1Ml8Mkp/fks1Ju8Z5z/XzodpH6HW6+WNGYQLE1c02IgjiJ:sxZn2Mp/fksjuC5r8aHbGccXj+
TLSH
T13962F9156E38597B9CDBD209FA597F93D7F9152391904E4899FCCA0C04E7ADC221382F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 30KB
SHA256 ddd93c640e662c502f8eb86638cc1df77a2298622f6e99b3321005e81ad97b67
MD5 05935d2041921213c2915352f66cfcb9
SHA1 da1777fe0ccc73476b61fb62b7ddeaded5a5d048
SHA512 12857425d3c7e0616dd87b28b12e481e52fac401d62cf2d444b3a35b85e2bfac067ef4244c51b9b84be70447d5a8135ce2be134629431716442650f79874268c
SSDEEP 768:cFADqXGWviq5i8F1+UoAYDCx9Tuqh0VfUC9xbog/OVfRLl5bKp7roK/X:cFADqXGWviq5iu1jaSRLDmpIK/X
TLSH
T16DD20B2F684CCB7E4F841E5CEC266F8B6DD802CB6A984D5447EA844C02C77EE512B5DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\f0ca5eeb-a345-4dd5-a4b3-1abaeeab9373\index-dir\the-real-index
Size 2KB
SHA256 021c4a4749217ff6388398ae83e343f8e661ec935e2de7b2132a56e23e9d8660
MD5 bc10b8e6de71a2191af6d589abaea37c
SHA1 2a53542a690bc2b5ee7be0d777af4aa246a196f0
SHA512 cde8baa2b04503dbc8aa49c7a9988ba3687a293055ff69e323cd529c1899463cae2753e17d9166753a21fabce1b594860b929e2457b83513e687e673547b689e
TLSH
T11451964E4D549A2EE858407315B364A433B099CC5750DA236CEC6131BD83B9E1D1F3AE
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5d0581.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\f0ca5eeb-a345-4dd5-a4b3-1abaeeab9373\index-dir\the-real-index~RFe5d0581.TMP
Size 2KB
SHA256 4993ab734ae2763542931cd9b6dae43dbb13d61da7a0f9ab8ffddaf8f4b42f60
MD5 f0e251a9d2f28f8699ae470f745976df
SHA1 eb98c3e50079b0e40b5c906a4220fc1809c9a1a5
SHA512 bb8f6a3e10c950cb012f10f7dd147a691c93d8c40f3c542e9127f6192587e5d15b150661c70d482bdeaa4bda36a8c49f2ab2a499d3aff926d66a5017f09887cb
TLSH
T1E551C88B4D818A3DE8D440730DE3B8B83336680087557F5378BC9235AD927AD3E0E2D9
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\index.txt
Size 371B
SHA256 12c94d597be4825350a86a89f97fbe129ecb11556b49d80864e9567fe029e5cd
MD5 1eb5b56a4464e84eb67b1a7f742dab2d
SHA1 ed5fddc20fb362b543b6051da66213f41898dec4
SHA512 713570c49daa3160b70a5e486b8061ff7efb3951650c3bc92958b28505fb97a585f5d4c942e528b57452206b2a93ad1e559af9589a2772dfb1ad2a140f89f967
TLSH
T10DE0C0762CE70824FC2FC7D62072109016113824C6047D0F203FB6C341B23457089D31
MD5 SHA1 SHA512 TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 22KB
SHA256 bd0af23f1552dc6a139ddc644025e3089171a0fd212c7f139cf9eefdf231e551
MD5 e41125381e870cb7a47fa9b52692a790
SHA1 4870723e9cb19379a67446b5c7f76ad2506b1ad3
SHA512 e92879e7e998096e0bd0d0ec37142b65486196b7e682e978b77ef3634a477ff1aac58b5a9d3f51d3f2489fababb9610048c11ac1367f4f2fc7a1a1ed4bb384b3
SSDEEP 96:KY5mKicqtEYKJ6SOhCKiYZ7yKoAS+/yKosjfmKoYuqugKnKA1OKOACqIgK9KeJ2H:cVSnNDxZ9l3iZ3QxVl/1hVPSRbG
TLSH
T15EA25916713A0612387D6D4CB3A69A3B4F4271A33418A5EF7FB810760E2AE125DFD8DD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 28KB
SHA256 b1b45ca33624f45298b6ad2f7387b98ef7966e23bcdb74e41fac5758931473c8
MD5 b0fe4d3eece0518bedebcd7e04bed522
SHA1 70c903a448c61f0ec6434bf8aa637021600ea8f9
SHA512 1609fac5b0d79d84239a3d604bbed7d30eaea239a6d3add3f19950f3512ef156afc4ae4088611796f439b3db9ee40cd721317c467e4a04faa0d47679a932345c
SSDEEP 384:n1iFiZcI33sNB8TUNTUlI4kEJTjUCifbGo/Vy+nDmrMXOinnTKwBODNZOCBLF7Ix:8FQ33Ywg0votZnDmiOinnewBKZO/3Zj
TLSH
T121D25B72DC68CA7BFDEA5A85B64E7603CEE041A3958C5AD4EADC6E1C00DB1DC130BC16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 24KB
SHA256 017ebc422d7cdc6a99b34ff3dc0dcd54b85a480569f76974711a9ac1f4256f0f
MD5 e108fa6905dcc396f0f5f4023eea0bde
SHA1 12bf5fd9e126b8bb0e6b51135bc8838e6e789e3a
SHA512 fcc081afc4d8fbe6df8e91964475fe3966ba117ddbe074a3b2465da44fcb58e268d6a647f3bc6e871126912569908e15640cac6e9e74dafa4ea9633575f27793
SSDEEP 384:nciF9CcmyWCs3sN28TUNTUlImkrJ1SJCifbGo/Vy+nDms7ehkP+lFYS/S1l9F7Im:HFccps37wgICotZnDms7ehkoFYS/2v
TLSH
T136B26C36EC98DA7BEDEA4FDAE64E7643DEE011A385985AD0DAD81D1C00DB1DC1307C26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 28KB
SHA256 37def05c0ab7204dd11fff38e42a0b9038013d8418a86def2e5924233fbb527a
MD5 ab7cbab9fe1f3f76d77bd77d6e5ad3ac
SHA1 c0b26e9e2ee75e4b5c6721d0c97dd270d0ac2972
SHA512 7831d4ed1036a0b79694a1b046ca4092e460a23c30e1e3cba77ccb15b8536f5c48e6a27bfa5b3ec0f0cfd23b7701566eaf0fc62d38d54fbae8802e3f5364fa83
SSDEEP 384:nbiFiZcI33sNB8TUNTUlI4kEJNDjUCifbGo/Vy+nDmrMXOinnTKwBODNZOCBLF7O:2FQ33YwgGvotZnDmiOinnewBKZO/3Zj
TLSH
T1A9D25B72DC68CA7BFDEA5A85B64E7203CEE441A3958C5AD4EADC6E1C00DB1DC130BD16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 25KB
SHA256 9f9fc657841c96aeb8628dcf84aee715ecd3ce794972158c69a9de099840bcf5
MD5 a7f2719fcecdcdb676d44469af583700
SHA1 4af595d2ee460a3b840014e4b7ea1fed9daeca43
SHA512 398845ba43b67607670bb5ea116a38d13da999a85203412b1d910e7c2d01adf496cc86539d76ba4fbed6b4573e8521dd0a0663d66b6d27dd27930222e00180af
SSDEEP 384:nxiF9CcmyWCs3sNl8TUNTUlImkrJn5hCifbGo/Vy+nDmrMXOknhkP+lFYS/S1l9t:YFccps3owgJKotZnDmiOknhkoFYS/2v
TLSH
T16CC25C32EC98CA6BFDE64BD5E64E7643DEE041A7864C5AE0EAC81D1C00DB1EC5307D16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 28KB
SHA256 062c97533b5c8fbae1d434b7eef529880fbc7397fb9ef746996942218d1505b0
MD5 efb12333728019933580b915026e82a6
SHA1 1659293babe762c505addd9552df6b163bfaf6cc
SHA512 b8e35b2e87bc493d4937e09cfdfdf764b6a0f7a27d7b97a6b13365c4bb316c798df017db5d404b35c0d9c0b852b25f7aeac07b5380a43b5cf993db7fe471c4f8
SSDEEP 384:ndiFiZcIcV3sNB8TUNTUlI4kEJTjUCifbGo/Vy+nDmrMX2nnTKwBODNZOCBLF7Ix:UFQY3Ywg0votZnDmi2nnewBKZO/3Zj
TLSH
T1F3D26B72EC68CA7BFDEA5A85B64E7603CEE44153958C5AE4EADC6E1C00DB1DC130BC16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 e644203a4757b18a3ad73912458453e3bc050cadeca81b1d80a8d5f0a308991b
MD5 eb65be2bb01e073c2f697f151b5395dd
SHA1 b02c15bb9701049a5ce024d404b7820a569f79b4
SHA512 7d9a5e7d940a3652cd3cf73a3d3071840d328d34a456d27ed409e51f2383575b0dd1f0a90dada1656b13394595aa2277a6029d5a561cacedc2d8b38c52065cc3
TLSH
T1B3412798A6FD1148B3B76F5AAFF6A86D483A78672F06D49D00110E4F4A63F40CD61B37
MD5 SHA1 SHA512 TLSH

Submit Download

memory/1772-200-0x00000248651B0000-0x00000248661B0000-memory.dmp

Download