3f6978cf30bc292ab5c3cee7df23f52768dbbe9932b9a16f3f21c00326a52e09

Analysis

max time kernel
148s
max time network
151s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
09/08/2026, 06:00

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
3f6978cf30bc292ab5c3cee7df23f52768dbbe9932b9a16f3f21c00326a52e09.html
Size 81KB
Sample260809-gqq2assalf
SHA256 3f6978cf30bc292ab5c3cee7df23f52768dbbe9932b9a16f3f21c00326a52e09
MD5 46e938a331374854e354aabd1e438347
SHA1 7d72156e3298141cc2626f7c955a759f849ada05
SHA512 5a32a9eb1ecb45667473b39e7558e0ab90efe67687ab1086801844df868341135cfa598ab82a7f3357d7eb1f7613e66b1a7a7ea57e71aa6e83af9a41d79a855e
SSDEEP 1536:sgoR+OrQf4OktqnkkbWpHXZ/1XuIm9BQOE2JKr:JOYbLWlm4
TLSH
T1108309B9F5A170325E13F970402F500FB97B646BE40C0AACF254DCE1AEF658A8567F29
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
124	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134307288565113613"	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-552508041-2681165170-3229858294-1000\{AE1FB426-CA04-4B1B-A0A2-F87123CCB4A5}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
5836	msedge.exe
5836	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
4772	msedge.exe
4772	msedge.exe
4772	msedge.exe
4772	msedge.exe
4772	msedge.exe

Suspicious use of FindShellTrayWindow 33 IoCs

pid	Process
4772	msedge.exe
4772	msedge.exe
4772	msedge.exe
4772	msedge.exe
4772	msedge.exe
4772	msedge.exe
4772	msedge.exe
4772	msedge.exe
4772	msedge.exe
4772	msedge.exe
4772	msedge.exe
4772	msedge.exe
4772	msedge.exe
4772	msedge.exe
4772	msedge.exe
4772	msedge.exe
4772	msedge.exe
4772	msedge.exe
4772	msedge.exe
4772	msedge.exe
4772	msedge.exe
4772	msedge.exe
4772	msedge.exe
4772	msedge.exe
4772	msedge.exe
4772	msedge.exe
4772	msedge.exe
4772	msedge.exe
4772	msedge.exe
4772	msedge.exe
4772	msedge.exe
4772	msedge.exe
4772	msedge.exe

Suspicious use of SendNotifyMessage 16 IoCs

pid	Process
4772	msedge.exe
4772	msedge.exe
4772	msedge.exe
4772	msedge.exe
4772	msedge.exe
4772	msedge.exe
4772	msedge.exe
4772	msedge.exe
4772	msedge.exe
4772	msedge.exe
4772	msedge.exe
4772	msedge.exe
4772	msedge.exe
4772	msedge.exe
4772	msedge.exe
4772	msedge.exe

Suspicious use of WriteProcessMemory 32 IoCs

description	pid	Process	procid_target
PID 4772 wrote to memory of 2880	4772	msedge.exe	89
PID 4772 wrote to memory of 124	4772	msedge.exe	90
PID 4772 wrote to memory of 4888	4772	msedge.exe	91
PID 4772 wrote to memory of 4888	4772	msedge.exe	91
PID 4772 wrote to memory of 244	4772	msedge.exe	92
PID 4772 wrote to memory of 244	4772	msedge.exe	92
PID 4772 wrote to memory of 244	4772	msedge.exe	92
PID 4772 wrote to memory of 2632	4772	msedge.exe	94
PID 4772 wrote to memory of 2632	4772	msedge.exe	94
PID 4772 wrote to memory of 2392	4772	msedge.exe	95
PID 4772 wrote to memory of 2632	4772	msedge.exe	94
PID 4772 wrote to memory of 2392	4772	msedge.exe	95
PID 4772 wrote to memory of 2392	4772	msedge.exe	95
PID 4772 wrote to memory of 1628	4772	msedge.exe	96
PID 4772 wrote to memory of 1628	4772	msedge.exe	96
PID 4772 wrote to memory of 1628	4772	msedge.exe	96
PID 4772 wrote to memory of 1056	4772	msedge.exe	97
PID 4772 wrote to memory of 1056	4772	msedge.exe	97
PID 4772 wrote to memory of 1056	4772	msedge.exe	97
PID 4772 wrote to memory of 3544	4772	msedge.exe	99
PID 4772 wrote to memory of 3704	4772	msedge.exe	100
PID 4772 wrote to memory of 3544	4772	msedge.exe	99
PID 4772 wrote to memory of 3704	4772	msedge.exe	100
PID 4772 wrote to memory of 1720	4772	msedge.exe	102
PID 4772 wrote to memory of 2540	4772	msedge.exe	106
PID 4772 wrote to memory of 4300	4772	msedge.exe	107
PID 4772 wrote to memory of 5736	4772	msedge.exe	108
PID 4772 wrote to memory of 2284	4772	msedge.exe	109
PID 4772 wrote to memory of 2284	4772	msedge.exe	109
PID 4772 wrote to memory of 1100	4772	msedge.exe	110
PID 4772 wrote to memory of 1100	4772	msedge.exe	110
PID 4772 wrote to memory of 5836	4772	msedge.exe	112

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument C:\Users\Admin\AppData\Local\Temp\3f6978cf30bc292ab5c3cee7df23f52768dbbe9932b9a16f3f21c00326a52e09.html
1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4772
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x260,0x264,0x268,0x25c,0x288,0x7ffcedffc188,0x7ffcedffc194,0x7ffcedffc1a0
  2⤵
  PID:2880
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1872,i,7700853351248205294,15338699929819475093,524288 --field-trial-handle=2324,i,12322704100526865124,15355100584828188794,262144 --variations-seed-version --mojo-platform-channel-handle=2956 /prefetch:11
  2⤵
  - System Time Discovery
  PID:124
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2420,i,9388021361334465172,15065253173224078584,524288 --field-trial-handle=2324,i,12322704100526865124,15355100584828188794,262144 --variations-seed-version --mojo-platform-channel-handle=3124 /prefetch:13
  2⤵
  PID:4888
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1696,i,4829944838822896190,10164928197124143950,262144 --field-trial-handle=2324,i,12322704100526865124,15355100584828188794,262144 --variations-seed-version --mojo-platform-channel-handle=2320 /prefetch:2
  2⤵
  PID:244
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3632,i,16359704526118118244,14926910576829015971,2097152 --field-trial-handle=2324,i,12322704100526865124,15355100584828188794,262144 --variations-seed-version --mojo-platform-channel-handle=3636 /prefetch:1
  2⤵
  PID:2632
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3644,i,7592309308221592570,10130877004067386114,2097152 --field-trial-handle=2324,i,12322704100526865124,15355100584828188794,262144 --variations-seed-version --mojo-platform-channel-handle=3640 /prefetch:1
  2⤵
  PID:2392
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4324,i,12588387336275356707,11742304852828220470,2097152 --field-trial-handle=2324,i,12322704100526865124,15355100584828188794,262144 --variations-seed-version --mojo-platform-channel-handle=4356 /prefetch:1
  2⤵
  PID:1628
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4328,i,12606898978734193295,7236433778051939012,2097152 --field-trial-handle=2324,i,12322704100526865124,15355100584828188794,262144 --variations-seed-version --mojo-platform-channel-handle=4364 /prefetch:9
  2⤵
  PID:1056
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5452,i,15632113447598023643,10282710173355839796,524288 --field-trial-handle=2324,i,12322704100526865124,15355100584828188794,262144 --variations-seed-version --mojo-platform-channel-handle=5520 /prefetch:14
  2⤵
  PID:3544
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5456,i,14127585852348447016,6478737382933289763,524288 --field-trial-handle=2324,i,12322704100526865124,15355100584828188794,262144 --variations-seed-version --mojo-platform-channel-handle=5540 /prefetch:14
  2⤵
  PID:3704
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6104,i,12478920727611035072,6012285401795801440,524288 --field-trial-handle=2324,i,12322704100526865124,15355100584828188794,262144 --variations-seed-version --mojo-platform-channel-handle=6120 /prefetch:14
  2⤵
  PID:1000
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6104,i,12478920727611035072,6012285401795801440,524288 --field-trial-handle=2324,i,12322704100526865124,15355100584828188794,262144 --variations-seed-version --mojo-platform-channel-handle=6120 /prefetch:14
  2⤵
  PID:1720
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4408,i,14056217349358367510,7733730117947588733,524288 --field-trial-handle=2324,i,12322704100526865124,15355100584828188794,262144 --variations-seed-version --mojo-platform-channel-handle=4508 /prefetch:14
  2⤵
  PID:2540
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4328,i,5419113540385742848,3409739589123336919,524288 --field-trial-handle=2324,i,12322704100526865124,15355100584828188794,262144 --variations-seed-version --mojo-platform-channel-handle=5156 /prefetch:14
  2⤵
  PID:4300
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5300,i,6083775464783581762,17450908879730013668,524288 --field-trial-handle=2324,i,12322704100526865124,15355100584828188794,262144 --variations-seed-version --mojo-platform-channel-handle=5108 /prefetch:14
  2⤵
  PID:5736
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5448,i,14025995843214233519,8905561677563149155,524288 --field-trial-handle=2324,i,12322704100526865124,15355100584828188794,262144 --variations-seed-version --mojo-platform-channel-handle=2872 /prefetch:14
  2⤵
  PID:2284
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3664,i,7263953997426008448,3882691942690841622,524288 --field-trial-handle=2324,i,12322704100526865124,15355100584828188794,262144 --variations-seed-version --mojo-platform-channel-handle=4512 /prefetch:14
  2⤵
  PID:1100
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=3532,i,1613154207563313182,6688798838018352687,262144 --field-trial-handle=2324,i,12322704100526865124,15355100584828188794,262144 --variations-seed-version --mojo-platform-channel-handle=5508 /prefetch:10
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5836

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:4996

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:5820

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 f8dff5315a0bd3856381f405c1a16257337fd6ff2d8043dd8bea22404cd35129
MD5 5e53a2cd139f0cce4f8ceab3e015f7da
SHA1 1bd884dbaaa352a724c53bfb8f4bfad2623c93f5
SHA512 27cc4cb62f9aa4af6b521efd824b001f3b689bae2ffe57263da18e2bb22d0b13ba656141d7e6ea1d1c202d5f461a44243a00d604f78bd5b04fe6b8512e260ac1
TLSH
T178D02B1463108D04D441F13214D13311B1110833A80C96440050E1284CB634206738DD
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 1f3bc43c50f7d0fa02f98500baf5d78052a5560603459a9325b17de989d121f4
MD5 46a6445fd2c83830bb8c6e03f85bafc0
SHA1 46b07e35efbd47692fdc81ef0e82e2964da2831b
SHA512 800f82b05756fd6fab3fe29924147f0b86afeec21da661e646b431c6ca03903eb45bb09803f5cdaf3d2d1bb16f95d0f2e53a1f9ddde57505b0f3e1580c384ed1
TLSH
T188D02B1063208C04D441F13214D23311B1010833540C96440150E1384CB634206728CD
MD5 SHA1 SHA512 TLSH

Submit Download

109d458b-544b-4ebc-b6f4-e163827b252e.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\109d458b-544b-4ebc-b6f4-e163827b252e.tmp
Size 23KB
SHA256 6732faa4337489691bc6860b7136d1a60c3ef724b2b576c8b4dbe9c4aff7d0f3
MD5 0aee68830d16f39f7c07124d7ada6019
SHA1 edee64e00182381d1bb307f4862d0b5508599a21
SHA512 5d8d48f95cc78c729da372ed8ea26d2dd30605712d686d3525c552f71032b6d24dea755d92902ae27665932a1b92101327cb5836844f54949ecb4ff9b244058f
SSDEEP 384:jjm+vhKfCtgQCFf4+KhOObJ+UoAYDCx9TuqZz0VfUCh7xbog/OVmC9qyRv7roZSz:jC+vhQWgQ+f4+8F1+UoAYDCx9Tuqh0Vk
TLSH
T1C3B2EA2B600DCB7F4F800AADAC196FD76D9802CB97589D4047FED90C02C77EA92194DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 1KB
SHA256 e336e85f2abf1f265fe30d07b97641f983e41e68cab651d9edaf7a1827e5a1f2
MD5 78177c750816483c602239dce54dc8cc
SHA1 6e7c792b2c6fa1a4b24c056ca0007b3ab82d9657
SHA512 b1c5e8b99dd2cca2416a4492e4123ff91f35bf165d7ce27bd11f95f0b0d24a0aa7217f4e792190db3d21b57ac01a9b32256ad192a9b6c4109ce697e54ff2c3b4
TLSH
T1F121B658AB3F9AC2FBBD69B265EBD5AA7239AB59CB036FF100D03878CC077092011550
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 6d591493a6f69d042fd3527089c4a360ba9b6bcac46b78274805e2ccbb3899c0
MD5 51b4d914157000a5e9a707276a2ef05b
SHA1 4039d274392bf865198adff9ac5acf1730b8876b
SHA512 6e5e5ee5d637cd0e773ef0e352689bd859d791948672b4ecb5a4d98b9c767bfea803aeac2db686aeae825fd74e7693e9860cf53a2325379d346317bf1769302a
TLSH
T11E419FF783F4867EC91196F0AA146E2FCE2D0515432C7C6689E4AE2B93E3471D14169F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 5e089f97b7f7916a4be1211f18240756654deb48bc5657a467334f95760c1525
MD5 87e082aa5fb68da1b37bde464ee37d5d
SHA1 3d5a502d384cd3e1aa9c52d4b90c632f4ee41ae0
SHA512 ab673ecb74dc19d05fc9233d3930bf2ba8a8fa631b014485eca74f4b2eb05cabb822a87e63468e0c67031191ce652dcb959659fec647bb20d6614da92daa0440
SSDEEP 192:sxRJRmbA/f4sa02Dde5lSIzoD8p48/g6+WNIYCN6suOCGpIgDHJ:sxRJGA/f4sa02c5lZJ/5IW0HN
TLSH
T17B32B716AA38A93B8CC7D21DBB55BF53D2F95032A1942E58E7FC961C04E77DD220740B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 d8cd2645c46c3a3be51667901746c1206d87fcb2f62ea2e4a4e6e3e8d50f4d21
MD5 8108a5569471a5e8f23e04d4afc36fa0
SHA1 1d0e0f053027848a16083e199f2546b7772e41d5
SHA512 2135a8f1a26f966bea8f80ff4ebe4e32057b655e36e8b3a019f5bd57fdd5d8eab5b701a186b441a418c6936a9f0b6eebb6bb257ea1dc002a9544a7da3f051b5c
SSDEEP 192:sxRJRmbA/f4sa0aDde5lSIzoD8p48/g6+WNIYCX68uOCGpIgDZJ:sxRJGA/f4sa0ac5lZJ/5IUEHX
TLSH
T17742B716AA38A93B8CC7E21DBB55BF53D2F9503261942E58B7FC961C04E77DD220740B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 fb7bc6cabaffe59e6e6fa498088bf0b41b70a7a1a34c785aaf97cbfb927b420f
MD5 506a59b6f8dde5471790980879bbea61
SHA1 2724f0f61c1be7e53f3945ca23efb842064ad555
SHA512 2bcf2db00f05c92d056fc6fa2d8bee7ff26e365bb37ae4999949011c3a9418329fee785c8399a4b5f6cafb730338d02c3c74f39da3f6ab85682f8af119d47095
SSDEEP 192:sxR+RmbA/f4sk02Dde5lSIzoD8p48/g6+WNIYCN6suOCGpIgIJ:sxR+GA/f4sk02c5lZJ/5IW0Hs
TLSH
T1A732B7165A38A93B8CC7E21DBB55BF53D2F95032A1D42E58E7FC961C04E76DD220740B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 8c1824d7d3aabc52766e369d69cb16b2403cd9fec89d914358bd7bf756c96565
MD5 f0414e413968c0e4d7c44c7b63aec863
SHA1 6a7b2b13cd188cf7ff5b086b4e6b5a32ba08ebeb
SHA512 8b0e78633db1b24e5c56dc5762f0aa7b6b21bf6b68c60f8149641f4636561f5e980ce05afd67f710291c6e8b865487098d38e6a6fb1ce8834cb4d6f597bb4eea
SSDEEP 96:KRbEBVj5J1WdSIg91K4EgT1c7j6dJOHmGmbmqmGmAmomomuWmYmNm1gmmmuK4mbe:CbEBVj5JAdSp9/EgTK7j6dJOHZ2HDxT1
TLSH
T165914101317B02817C3DA64C84B9C86F82C1B0663416B76B7FA946664F66E479DFF8CD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

f5fb6011-115f-4703-8204-f4b8f0d736ff.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\f5fb6011-115f-4703-8204-f4b8f0d736ff.tmp
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 40KB
SHA256 09b16f9b795094fd26c9bbe6a4dd2e1380b3903801be83b880a38b70031db2aa
MD5 c7b766ecaff16af2615da9ce446486dd
SHA1 ed9da572b5f1de74508a6dc69b6860884c81099a
SHA512 79d02e9cfceff92379fb48c642adc3ad39ff2ead3325f885a31a1943fcb6045eac43d7ba6cd7ce11027b2df836ddab9a06309b74b6828c0e16e73104c3fe8b31
SSDEEP 768:Trv+4UNbdS3rSx1uDt/Ymp8+p3bd66j+4BRv86aLIWj2bwClP:Tbsb03eQ8+p3Z6n4yJ0w6
TLSH
T18E13BE72F968AD339CF6C644B14676837FF851A386C00ED4E4DD6B4E019A1AE630F927
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 41KB
SHA256 b6bdf5cb0b2c56a3a587fe506b800b6d9250614c8388e1042537c7eddf3c7d42
MD5 58965b8314b5a025f3e0a09217bbde27
SHA1 e149827b65af4f8a86e9678eb0e3e5bf2fe18548
SHA512 5bd65f7dd1c50e1a0b32ce02d71c15275e560f49030aa166fd300b638679697008e5c3fd9e9f8c5b07d59d4a2fe3fb9da185ab200cb77659e6bbe95ae31a52d9
SSDEEP 768:zrv+4UNbdS3IS51uDt/YEp8+p3bd66j+4BRv86aLIWj2bwClP:zbsb03DS8+p3Z6n4yJ0w6
TLSH
T17613AE72F968AD339CF6C644B14676837FF851A386C00ED4E4DD6B4E019A1AE630F927
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 39KB
SHA256 1395b80709a6b4e3263afd3f4647ee1eb2525e7e3c76479178b9ef578ed88ad3
MD5 c14eda534a865b82a7cb929f61a4f1b0
SHA1 ca08a6c9b227a511c829454aca83c5c11ce43f34
SHA512 1ea0a84112eaca5c2effcf675b799735f0571cb19d764442a2237b13c9bba52131da557da2b16fcbae3a9910ab83adbf75becef7354f3ab4753df4847a6f1984
SSDEEP 768:/rv+4UNbdD3V18Dt/YNp8+p3bd66j+4BRv86aLITj2bwCl1:/bsbp3LL8+p3Z6n4yi0ww
TLSH
T1BD03BE73E968A9339CF6C684B146B6437FF851A396C10ED4E4DD2B4E019B19E630B837
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 35KB
SHA256 5e6959db0782fd1eb64b4713804a021640d0149691a712e11aa81e2e73949a9f
MD5 295ee304da3a7d64084b4a3e511313f9
SHA1 abf375a60e93a79ef6fac3eeb8c87d6ba6ddfde8
SHA512 fc1a8afc204389d812caf0d36b78fa5d2089d80110b9a999a73598df89d62f5bb2c7b29ef2ab2a23870f18e1b726cbf86e7c10c53e0c4122d78bb787061c844b
SSDEEP 768:p13l51uDt/YEp8+p3bd66j+4BRv86aLIWj2ewBKZOnM:p13LS8+p3Z6n4yJ2evZOM
TLSH
T130F2AEB2EC699D33CCE6D648B24672436EF451A3A6C41EA8E4DD7B0D00972AD170BC36
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 37KB
SHA256 3dbf8506b5df5eefa0b73de26b156116747a878f6b96f5ccb8cd9278a505da0a
MD5 02ee006a8abc9ec9f818384c520193d6
SHA1 4d2fb3271237e02d5c593f29b4c2e905388026ad
SHA512 6ee407d2968de0bcb6c0b2adad03e0089d039dc8882fa27a9156234e0165e26fbf650fb2b33c02b9f8c82a94943d9e3dd0e8d29182f71b97fccc40679366146c
SSDEEP 768:VFQz3gwgI51uDt/Ep8+p3bd66j+4BRv86aLIWj2ewBKZOnM:0z378+p3Z6n4yJ2evZOM
TLSH
T184039EB2D8A8CD37DCF6DB88F6463243AEF441A3D5C46EA4E5DD6A0D109719D130BC26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 013cc1e906af47afcdcf27187e38325c57ff77a533120000f7bdc4756a5fb0c9
MD5 5936f9c10a47ab5f144c8e5fd18f6808
SHA1 a4140159a302900e98dfa9ff8f1df35b46799b24
SHA512 79e19de0c776872da4e539ad6801621cd7a1f57be517bab50fbb6aeaa06f0ff0992f7cf4eb3b50577c3d7ce504b0fffc41d1a2c55cca8854bea6fa4aabe1fb06
SSDEEP 768:Irv+4UNbdD3lcDtFNp8+p3bd66j+4BRv86aLIi32bwCl1:Ibsbp3kL8+p3Z6n4yx0ww
TLSH
T1BC03CE73F96899339CF6C644B2867A837FF851A396C10EC4E5DD2B4E015A19E230BC27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

af883e53-cc60-4f5f-86c4-6db663c3839a.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\af883e53-cc60-4f5f-86c4-6db663c3839a.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download