1e98bdda4ece5253c03226996152216364ccab7bc7e5a2ad6dc690de298cae50

Analysis

max time kernel
148s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
08/08/2026, 02:55

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Ad Avenger 11.html
Size 28KB
Sample260808-delewsgm2s
SHA256 1e98bdda4ece5253c03226996152216364ccab7bc7e5a2ad6dc690de298cae50
MD5 1a151c425bc3b5ade87da248ecd62246
SHA1 84db4917e9afdde59bb721c541e5643c91c1f9ec
SHA512 7f46180d7b31ee383575c5049ddcc5ad506788f1613ef5ce0003358a91ca9b51a636dc9e587acb8d3fc9e87e0b93ea8a25fedc5487863b827adcff1d2ccca37e
SSDEEP 768:tW21rOTfQ2TdDTfQ7WIIIfflsTfQXTfQjPHPOGbBTLaq6:4urWSWIIIX4PmGb1J6
TLSH
T188D23133A0A54C73103B8ED5E839674D72E7D30AEB1B3854A6EC83D497CDE60E4A9B45
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4344	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134306313370669796"	msedge.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-889581200-2041691093-2048517887-1000\{663206E3-CEC7-4718-A0FB-23C6075F98CB}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3356	msedge.exe
3356	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
4868	msedge.exe
4868	msedge.exe
4868	msedge.exe
4868	msedge.exe
4868	msedge.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
4868	msedge.exe
4868	msedge.exe
4868	msedge.exe
4868	msedge.exe
4868	msedge.exe
4868	msedge.exe
4868	msedge.exe
4868	msedge.exe
4868	msedge.exe
4868	msedge.exe
4868	msedge.exe
4868	msedge.exe
4868	msedge.exe
4868	msedge.exe
4868	msedge.exe
4868	msedge.exe
4868	msedge.exe
4868	msedge.exe
4868	msedge.exe
4868	msedge.exe
4868	msedge.exe
4868	msedge.exe
4868	msedge.exe
4868	msedge.exe
4868	msedge.exe
4868	msedge.exe
4868	msedge.exe
4868	msedge.exe
4868	msedge.exe
4868	msedge.exe
4868	msedge.exe
4868	msedge.exe
4868	msedge.exe
4868	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
4868	msedge.exe
4868	msedge.exe
4868	msedge.exe
4868	msedge.exe
4868	msedge.exe
4868	msedge.exe
4868	msedge.exe
4868	msedge.exe
4868	msedge.exe
4868	msedge.exe
4868	msedge.exe
4868	msedge.exe
4868	msedge.exe
4868	msedge.exe
4868	msedge.exe
4868	msedge.exe
4868	msedge.exe
4868	msedge.exe
4868	msedge.exe
4868	msedge.exe
4868	msedge.exe
4868	msedge.exe
4868	msedge.exe
4868	msedge.exe
4868	msedge.exe
4868	msedge.exe
4868	msedge.exe
4868	msedge.exe
4868	msedge.exe
4868	msedge.exe
4868	msedge.exe
4868	msedge.exe

Suspicious use of WriteProcessMemory 32 IoCs

description	pid	Process	procid_target
PID 4868 wrote to memory of 4032	4868	msedge.exe	84
PID 4868 wrote to memory of 4344	4868	msedge.exe	85
PID 4868 wrote to memory of 760	4868	msedge.exe	86
PID 4868 wrote to memory of 760	4868	msedge.exe	86
PID 4868 wrote to memory of 760	4868	msedge.exe	86
PID 4868 wrote to memory of 3176	4868	msedge.exe	87
PID 4868 wrote to memory of 3176	4868	msedge.exe	87
PID 4868 wrote to memory of 1844	4868	msedge.exe	88
PID 4868 wrote to memory of 4640	4868	msedge.exe	89
PID 4868 wrote to memory of 1844	4868	msedge.exe	88
PID 4868 wrote to memory of 1844	4868	msedge.exe	88
PID 4868 wrote to memory of 4640	4868	msedge.exe	89
PID 4868 wrote to memory of 4640	4868	msedge.exe	89
PID 4868 wrote to memory of 1776	4868	msedge.exe	90
PID 4868 wrote to memory of 1776	4868	msedge.exe	90
PID 4868 wrote to memory of 1776	4868	msedge.exe	90
PID 4868 wrote to memory of 1060	4868	msedge.exe	91
PID 4868 wrote to memory of 1060	4868	msedge.exe	91
PID 4868 wrote to memory of 1060	4868	msedge.exe	91
PID 4868 wrote to memory of 2392	4868	msedge.exe	96
PID 4868 wrote to memory of 4580	4868	msedge.exe	97
PID 4868 wrote to memory of 2392	4868	msedge.exe	96
PID 4868 wrote to memory of 4580	4868	msedge.exe	97
PID 4868 wrote to memory of 4748	4868	msedge.exe	99
PID 4868 wrote to memory of 4320	4868	msedge.exe	114
PID 4868 wrote to memory of 3708	4868	msedge.exe	115
PID 4868 wrote to memory of 2368	4868	msedge.exe	116
PID 4868 wrote to memory of 1668	4868	msedge.exe	117
PID 4868 wrote to memory of 1668	4868	msedge.exe	117
PID 4868 wrote to memory of 3876	4868	msedge.exe	120
PID 4868 wrote to memory of 3876	4868	msedge.exe	120
PID 4868 wrote to memory of 3356	4868	msedge.exe	127

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument C:\Users\Admin\AppData\Local\Temp\Ad Avenger 11.html
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4868
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x260,0x7ffdf809c188,0x7ffdf809c194,0x7ffdf809c1a0
  2⤵
  PID:4032
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1776,i,15226471568167744901,4104438432723156631,524288 --field-trial-handle=2304,i,17495861531505290539,9176649302279500609,262144 --variations-seed-version --mojo-platform-channel-handle=2432 /prefetch:3
  2⤵
  - System Time Discovery
  PID:4344
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1648,i,8677648251060763775,2738573783726470555,262144 --field-trial-handle=2304,i,17495861531505290539,9176649302279500609,262144 --variations-seed-version --mojo-platform-channel-handle=2300 /prefetch:2
  2⤵
  PID:760
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2476,i,14113285028267576286,6824250126647482863,524288 --field-trial-handle=2304,i,17495861531505290539,9176649302279500609,262144 --variations-seed-version --mojo-platform-channel-handle=2492 /prefetch:8
  2⤵
  PID:3176
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3428,i,6727300763610307349,12498235205102762411,2097152 --field-trial-handle=2304,i,17495861531505290539,9176649302279500609,262144 --variations-seed-version --mojo-platform-channel-handle=3500 /prefetch:1
  2⤵
  PID:1844
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3432,i,8348339565141365334,13854487876022691013,2097152 --field-trial-handle=2304,i,17495861531505290539,9176649302279500609,262144 --variations-seed-version --mojo-platform-channel-handle=3504 /prefetch:1
  2⤵
  PID:4640
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4252,i,15563847499911627139,7871464729305534756,2097152 --field-trial-handle=2304,i,17495861531505290539,9176649302279500609,262144 --variations-seed-version --mojo-platform-channel-handle=4248 /prefetch:1
  2⤵
  PID:1776
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4312,i,7847103913698604443,15192268494353531068,2097152 --field-trial-handle=2304,i,17495861531505290539,9176649302279500609,262144 --variations-seed-version --mojo-platform-channel-handle=4288 /prefetch:2
  2⤵
  PID:1060
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5008,i,17230318384989871475,561024148250297299,524288 --field-trial-handle=2304,i,17495861531505290539,9176649302279500609,262144 --variations-seed-version --mojo-platform-channel-handle=5184 /prefetch:8
  2⤵
  PID:2392
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5136,i,16046057550925025107,129692596194671904,524288 --field-trial-handle=2304,i,17495861531505290539,9176649302279500609,262144 --variations-seed-version --mojo-platform-channel-handle=5208 /prefetch:8
  2⤵
  PID:4580
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5896,i,10286918660501418376,10532074729421039074,524288 --field-trial-handle=2304,i,17495861531505290539,9176649302279500609,262144 --variations-seed-version --mojo-platform-channel-handle=5940 /prefetch:8
  2⤵
  PID:1832
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5896,i,10286918660501418376,10532074729421039074,524288 --field-trial-handle=2304,i,17495861531505290539,9176649302279500609,262144 --variations-seed-version --mojo-platform-channel-handle=5940 /prefetch:8
  2⤵
  PID:4748
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4268,i,11789847683078476367,3217591122991688285,524288 --field-trial-handle=2304,i,17495861531505290539,9176649302279500609,262144 --variations-seed-version --mojo-platform-channel-handle=4288 /prefetch:8
  2⤵
  PID:4320
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4516,i,11874993175387695051,12651099279010533366,524288 --field-trial-handle=2304,i,17495861531505290539,9176649302279500609,262144 --variations-seed-version --mojo-platform-channel-handle=4272 /prefetch:8
  2⤵
  PID:3708
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4520,i,16395374763686564359,17852885930286547511,524288 --field-trial-handle=2304,i,17495861531505290539,9176649302279500609,262144 --variations-seed-version --mojo-platform-channel-handle=5952 /prefetch:8
  2⤵
  PID:2368
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3516,i,8693391535067687527,1458206909190671501,524288 --field-trial-handle=2304,i,17495861531505290539,9176649302279500609,262144 --variations-seed-version --mojo-platform-channel-handle=3024 /prefetch:8
  2⤵
  PID:1668
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5716,i,444870948074750182,16076556405616170005,524288 --field-trial-handle=2304,i,17495861531505290539,9176649302279500609,262144 --variations-seed-version --mojo-platform-channel-handle=5240 /prefetch:8
  2⤵
  PID:3876
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=5384,i,4841511554807666030,14343106831603139406,262144 --field-trial-handle=2304,i,17495861531505290539,9176649302279500609,262144 --variations-seed-version --mojo-platform-channel-handle=6136 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3356

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:1588

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 11d3c4c52f9fc9cd2b10a22b48769759f994fd6364f9a0fc145f4cd2c2a22e9d
MD5 4751cf705a737c4226029624bf43b9a8
SHA1 fd8cf726ee3f8f75b97147829de5553530caa82c
SHA512 46e3fedbf7fa14bdc2b3aad129f2879a9d24252f5d7bd9b55766bc32a6b82ea77aaf193bcdbdf4423e3b67ef84955e589b6077609344091ef72204c1d50b0dab
TLSH
T17ED09B307A58A58BD14360F1A4114B4115375557205397757521508E9E98055B3CA057
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 701082e4ac35f878dc5ff6eb27989aae9d20d9b5662643e20b3acd1720b367fc
MD5 2b3686986ce1fd99f079eb226e8b0a8b
SHA1 0d2cdee36351378b91ed7f6ecdb43457fe4d7b5d
SHA512 937da61c495fd21a02bb76a63556dec83ce132f1d1830ff8d9af6212d15f1844766dd4abadd15ea61b48f8ae03b52baca44c99117714c705da840dbff8f116dd
TLSH
T182D09B303A58A98BD54360F1A4104B41153755572053D7757521508E9E99095B3CA057
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 2KB
SHA256 c3092c3cce38b51e72e2648117f4f8db3f1e097ffb463e8283a555b459c27eda
MD5 ae1e5d6560d5756e141a59900426dae0
SHA1 4b8d595f0f43aec7d834844fd05acf81496962a3
SHA512 f8ed5b3d4abbd659dca6d30c3ad5914921d0784c98046dc133dd5372d1d3ce57f3b3d58162911a103d13e7a1da1d1404929e2f6ce277e93c7e41aece67488331
TLSH
T1A7515EB854826523E7251031A1DA2F7E38B6BFDAFE5BCD7780908D32450FBE18369478
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe58ff2b.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe58ff2b.TMP
Size 2KB
SHA256 d162f3eebd38aa36f2f970f57b34298167b404c86520291228c1e77c0e253f75
MD5 36d81d5dff01237df234b240269f29be
SHA1 c85db671fb94c177859260d621f2ca161689bcb5
SHA512 7cd00f8fbe50e80f81d6c0e70e7c2662138819099af78695df2b88adafa81ee678c2e16849daf9e2a5851f10af6ff8fe14b93c145fa60cff250d6a4efcb41658
TLSH
T1B85161B854826563E7251031A1DA2F7E3876BFD9FE4BCE7740908D36450F7D18369474
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 b8760107f5a3384dd0bd064fe8dc5798095c4801b86e6071156bc753d14d3be8
MD5 3af6819f305c1e43c36e089b22beff6d
SHA1 63a9430a7c6eacc82c6dc9fe69f5a026276f1147
SHA512 5edbf217297f8a1cb2945a942787e85c5b3e1e330540a95b2fd6a4e5302d464fae63578268655b3fca338f2bd3c9dd07c4f5bc528c5cdcc262ad17964e75464f
TLSH
T17B414CB7C3D486BE891552F19A24AE27CD2E055A422C3C56CDE4AF1B63E24B1D10169F
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 472edaf6ad6e65805c5b335a888d874e43e6e70b8b8d529b01a2e1ba628d3650
MD5 beee1a1ba3d4a61dd5f6db67691b5c0b
SHA1 4b4bb8cd40a011d6dbcde5fe3037dbf9c2e18d28
SHA512 d81fc50faf1335ddb5dd7366a790f92b3ca37a7766c4380f0832faaa558bd29db6d95504143ec1a6c80bde5eba1d5e53629c741f479dae36d9a7c51ec547a750
SSDEEP 192:sxZ+RDyM/jK1Ml8MkH/f3s1Nn1IdpdtHW6+WNGY9IKS82+0IgrJ:sxZ+dMH/f3s1NGTHbGxzb9
TLSH
T1AA42F911AA34A977CCDBD20DFA557F53D6F81472A2900E48A9FCD91C04E7AED221782F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 1a506de10c56efd33fce003636e3dd5998bc6114d8ca32f1ecca8fb20ceb16f2
MD5 0d8fda4cad6c40ee8b2a88e0df6e5654
SHA1 ec4dff25aef2bae3a6f9735ef335d8fc6f17feb4
SHA512 139949a730e5c62bb3d72e5f3a11aac92aafee9b87d45c2076db3850817ff9cca78f4171e76d4181acaa654a4a353654ee2558837208d153aa6de9b00a58701d
SSDEEP 192:sxZ+RDyM/jK1Ml8UQqkH/f3ssyOn1IdpHtHW6+WNGY9I0Sn9+0Ig5EJ:sxZ+dq5H/f3ssnGNHbG/9b+
TLSH
T1A352F811AA345977CCDBD20DFA457F93D6F8547292900E48A9FCDA1C04E7AED222782F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 30KB
SHA256 626a9143d7cbda574adcedd40a3370bc605efbf47c3b9853cfe837cb7d9fd9fd
MD5 23bf68ead7b7425794dbcac04f6126f1
SHA1 4d5ac7334547c02702a023e58fe53eddb30c5625
SHA512 6e5f5bc6947b9cf9a3ce593f1fc57773f0eb7a110a45163aa2faeb4206d15816d99df7341db7cf52e914f5e6e056bce1f5261a05da9f1169cbc28ac831c1016e
SSDEEP 768:Vucv21wWvu+Z+8F1+UoAYDCx9Tuqh0VfUC9xbog/OVjFLlwmWNCrodg6X:Vucv21wWvu+Z+u1jaeFLeRNZdH
TLSH
T19FD20A2B280CCB7E4F841E9CED2A6F8A6DD801CB57988D5447FA894C03C77EB511B59B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 5KB
SHA256 233e1959b5efe3ceb627f7671f4ef9e8b005a5b5b06b0b49f2a199cd6c34581a
MD5 f0e812e0aeafa5d3764bd66412db918b
SHA1 d332f64b7287f91e45246a7f4d9f7b246079fddf
SHA512 236497618dda331487027951a7531aa710aee2b9c3a2ce584ae3653dc906a36d3b83280a36d59b7c51dfa2bd353913f447337cce57838f0fa30a483cd78bd834
SSDEEP 96:KaRklRnHnqlPKZThqKLfTzqHxJSrBDKAIKZSGON2KWwCnr+JFTBBdI9UQqtdKCc3:mT3LVxnr+JFTBBi9UBtXcqzs7z7cU
TLSH
T1EAC12712303F0242297D7908B36A8536AE4172677918A8BF7BB910A15F27E221DFDDDD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 19KB
SHA256 5f9fb86050d351b8682b57d96674e47fbef756475406ffa92dcfa6749e160c67
MD5 96f1a37c9536aa1b3d9740bae070509b
SHA1 37850b8af923d13facac7302311660c961e0d7fd
SHA512 676a3ccb2ddf34a235ad660e8bf2cdef8dd3b540cabc8beb293a4462e5f0a9df2abfccbd70b5f72d9a5f8bff4b53ac712c04b5eaaa0cdca7a374c9978d0d80ad
SSDEEP 384:I6ZcIhsNgU5uBAzi9npSxe+CQdi++EknTKwBODNZOChWO:9hdWcZ4ExEknewBKZOYWO
TLSH
T1CB928E719C381C7A9EE6B544F84B31078EF89073E6C53B94D5ECAF1C05DA698131BC26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 fa9541fe60b071ae43a685de3ff64017effee76901a39f36161de2b8100d34dd
MD5 a82e556a2f41bdc925cf9de40020abd5
SHA1 f34e04de7bd16ceaaaf45a1bf306ab3b12491dc2
SHA512 7de14fa3ec76328c8ce33790a6e9e26108b2fedf1e70ca91ce57ae3b2526b76e1a3668632bc5d51dc0ea6f0eabbaa82384acd544214f10f332398cb495491c33
SSDEEP 192:JONB6v+YLNQmiUyrcZh+CG6+FdetRLus5LTU6:JONB6vz/dZh+CQdMBU6
TLSH
T1A802EB35AC782CAB9BF26E05F48736135FE4107BE9962F90DAD81F1C01D775C2306926
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 20KB
SHA256 98b12ae34299c4cccffaaccccb20fc66e277f5cae2249ba92b7666b07b6f39bc
MD5 8c0c0658e1bf77b31f787e5e20c8145b
SHA1 9a5b577361d72d4958b7e1d809a443fdf09b8f9c
SHA512 dcb9d547f38c2e4a2cbc35863914483f4b9bbfdf31633559d08b236c07064b76558bc9c0336fba0bafe683746618d3d2b2a1e7fdfd939ddf94bcf64ddc513acc
SSDEEP 384:56ZcIhsNgUGuBAzi9npSxe+CQdi++EknTKwBODNZOChWO:yhwWcZ4ExEknewBKZOYWO
TLSH
T127927E719C381C7AAEE6B548F84B31078EF89073E6C52BA4D5ECAF1C05DA658131BD26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 d91ab9d91b06f8685a47ece3edee15412f5a018af3131ac4f9d02a2ad6d1aa99
MD5 f31ef1b6fc4aaa75bb4d000e19578436
SHA1 a12c5c849708c007e6c448a912ebf2ce88bd025e
SHA512 477a21e5b66a82364767aa597256435339020917b0745ff90924046c5a6d1cfaab8a7937f5abd54ab47b0624650be05dd7a0d5edadd709812c4c97a4285a501d
SSDEEP 192:S7ONq6v+YLAUQmiUyrcSDh+CG6+FdetRLXx++bCHCqkU6:S7ONq6vzUk7SDh+CQdi++okU6
TLSH
T1BD122B35A8785C6B5EE2A944F48735135FE45127EACA7FD0E6DC2F0C06EF69C130A826
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 22KB
SHA256 38be306d15710f69bda60d27bc86e869975ddc52cdad91ae328cd625e292daee
MD5 0168c7a9627a2e3c10c03e30c1f7c1b7
SHA1 039588d8473849ccc7b89997fc728f36e70215b5
SHA512 d87546983ba5dca5a22b48eb067391ebf86c0ae7e2f4f3334e6bff8d28306b73fbb053e09a6ef0d978a245dcbf2b713706686896afba77bb70f3014528d9f74a
SSDEEP 384:x2iFiZcI2zsNB8TUNTUlIlGuBAzi9npSxe+CQdi++NknTKwBODNZOChWO:jFQGEwghWcZ4ExNknewBKZOYWO
TLSH
T1DFA26D739C685C7BAEE6AB44F94B31038EF85073D5C57AA4E7DCAE0C1197198130BC26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

fc03dea6-1ffa-4f49-b213-e805de248cd3.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\fc03dea6-1ffa-4f49-b213-e805de248cd3.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 37b43a179264e2125a6c138ccfe7a80f741c61f831c0dd3a541fe978b38222b0
MD5 90ff1af7340ce04a65cc97a4435014a2
SHA1 80a4f02c359aa98fe4bed284e298db5353135c91
SHA512 fbd36c32aa77cd9e5e20302cc8ce7a7e34f29e801e95ebd4f63561ce425960f2efa83f4bca6dce0846234a051fc65a5cca0dc184d140183e2da5fb2006d64a04
TLSH
T10B413B9CAAE90118B3776E569BFBA86D447FB8772E06D59D10010D4F0523B00CD71B37
MD5 SHA1 SHA512 TLSH

Submit Download