0e3df7e8abedbf3619ed39c5ee87a9299b7f03ab61a9ec9c525912ab6800f7c7

Analysis

max time kernel
149s
max time network
166s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
09/08/2026, 07:13

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
resources/public/index.html
Size 383B
Sample260809-h19f3ashmb
SHA256 0e3df7e8abedbf3619ed39c5ee87a9299b7f03ab61a9ec9c525912ab6800f7c7
MD5 e582b9106fb430459c697d4c5a519c25
SHA1 418242c0ee36e592982e3569c6bbb78f7274546a
SHA512 dcc2c76bda2f6567f90161911ab49600cd7896ee5607a4bfb842439189745156941c20d32b09d64b2554f1184b413f0b9f7399ec10013452cd45b791a39c96a3
TLSH
T112E0DF43C0E18809D32182700CC1F15D4BA2F6DBA7CA6D49B98A20898FC0B90CED72E9
MD5 SHA1 SHA512 TLSH

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
1244	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134307335102310225"	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-3797332335-34111092-3597280141-1000\{A97C6439-792C-419C-AC88-4C0EA33C6A18}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
5020	msedge.exe
5020	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
4812	msedge.exe
4812	msedge.exe
4812	msedge.exe
4812	msedge.exe
4812	msedge.exe

Suspicious use of FindShellTrayWindow 33 IoCs

pid	Process
4812	msedge.exe
4812	msedge.exe
4812	msedge.exe
4812	msedge.exe
4812	msedge.exe
4812	msedge.exe
4812	msedge.exe
4812	msedge.exe
4812	msedge.exe
4812	msedge.exe
4812	msedge.exe
4812	msedge.exe
4812	msedge.exe
4812	msedge.exe
4812	msedge.exe
4812	msedge.exe
4812	msedge.exe
4812	msedge.exe
4812	msedge.exe
4812	msedge.exe
4812	msedge.exe
4812	msedge.exe
4812	msedge.exe
4812	msedge.exe
4812	msedge.exe
4812	msedge.exe
4812	msedge.exe
4812	msedge.exe
4812	msedge.exe
4812	msedge.exe
4812	msedge.exe
4812	msedge.exe
4812	msedge.exe

Suspicious use of SendNotifyMessage 16 IoCs

pid	Process
4812	msedge.exe
4812	msedge.exe
4812	msedge.exe
4812	msedge.exe
4812	msedge.exe
4812	msedge.exe
4812	msedge.exe
4812	msedge.exe
4812	msedge.exe
4812	msedge.exe
4812	msedge.exe
4812	msedge.exe
4812	msedge.exe
4812	msedge.exe
4812	msedge.exe
4812	msedge.exe

Suspicious use of WriteProcessMemory 30 IoCs

description	pid	Process	procid_target
PID 4812 wrote to memory of 2280	4812	msedge.exe	89
PID 4812 wrote to memory of 5836	4812	msedge.exe	90
PID 4812 wrote to memory of 1244	4812	msedge.exe	91
PID 4812 wrote to memory of 5836	4812	msedge.exe	90
PID 4812 wrote to memory of 5836	4812	msedge.exe	90
PID 4812 wrote to memory of 2800	4812	msedge.exe	92
PID 4812 wrote to memory of 2800	4812	msedge.exe	92
PID 4812 wrote to memory of 1064	4812	msedge.exe	93
PID 4812 wrote to memory of 1064	4812	msedge.exe	93
PID 4812 wrote to memory of 1064	4812	msedge.exe	93
PID 4812 wrote to memory of 5684	4812	msedge.exe	95
PID 4812 wrote to memory of 5684	4812	msedge.exe	95
PID 4812 wrote to memory of 5684	4812	msedge.exe	95
PID 4812 wrote to memory of 1136	4812	msedge.exe	96
PID 4812 wrote to memory of 1136	4812	msedge.exe	96
PID 4812 wrote to memory of 1136	4812	msedge.exe	96
PID 4812 wrote to memory of 2752	4812	msedge.exe	97
PID 4812 wrote to memory of 2752	4812	msedge.exe	97
PID 4812 wrote to memory of 2752	4812	msedge.exe	97
PID 4812 wrote to memory of 4092	4812	msedge.exe	99
PID 4812 wrote to memory of 6096	4812	msedge.exe	100
PID 4812 wrote to memory of 4092	4812	msedge.exe	99
PID 4812 wrote to memory of 6096	4812	msedge.exe	100
PID 4812 wrote to memory of 724	4812	msedge.exe	102
PID 4812 wrote to memory of 1160	4812	msedge.exe	106
PID 4812 wrote to memory of 2876	4812	msedge.exe	107
PID 4812 wrote to memory of 4748	4812	msedge.exe	108
PID 4812 wrote to memory of 1012	4812	msedge.exe	109
PID 4812 wrote to memory of 1012	4812	msedge.exe	109
PID 4812 wrote to memory of 5020	4812	msedge.exe	111

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument C:\Users\Admin\AppData\Local\Temp\resources\public\index.html
1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4812
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x260,0x264,0x268,0x25c,0x288,0x7ffa77fcc188,0x7ffa77fcc194,0x7ffa77fcc1a0
  2⤵
  PID:2280
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1680,i,17242978684107517421,6283208571671765602,262144 --field-trial-handle=2828,i,2960675535100469609,15657186485120434660,262144 --variations-seed-version --mojo-platform-channel-handle=2824 /prefetch:2
  2⤵
  PID:5836
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1864,i,4121172210361444278,10839157742698275103,524288 --field-trial-handle=2828,i,2960675535100469609,15657186485120434660,262144 --variations-seed-version --mojo-platform-channel-handle=2912 /prefetch:11
  2⤵
  - System Time Discovery
  PID:1244
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2216,i,10034972619401962649,10046558839487833648,524288 --field-trial-handle=2828,i,2960675535100469609,15657186485120434660,262144 --variations-seed-version --mojo-platform-channel-handle=3184 /prefetch:13
  2⤵
  PID:2800
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3576,i,10549946673381270550,4436074310091482293,2097152 --field-trial-handle=2828,i,2960675535100469609,15657186485120434660,262144 --variations-seed-version --mojo-platform-channel-handle=3608 /prefetch:1
  2⤵
  PID:1064
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3572,i,3471626202719729090,15023917557398439831,2097152 --field-trial-handle=2828,i,2960675535100469609,15657186485120434660,262144 --variations-seed-version --mojo-platform-channel-handle=3604 /prefetch:1
  2⤵
  PID:5684
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4316,i,16643885212346443495,17452882124299560054,2097152 --field-trial-handle=2828,i,2960675535100469609,15657186485120434660,262144 --variations-seed-version --mojo-platform-channel-handle=4468 /prefetch:9
  2⤵
  PID:1136
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4328,i,10341237064595424846,8086042274425969668,2097152 --field-trial-handle=2828,i,2960675535100469609,15657186485120434660,262144 --variations-seed-version --mojo-platform-channel-handle=4464 /prefetch:1
  2⤵
  PID:2752
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5400,i,17779428260564765447,4407154632555356704,524288 --field-trial-handle=2828,i,2960675535100469609,15657186485120434660,262144 --variations-seed-version --mojo-platform-channel-handle=3588 /prefetch:14
  2⤵
  PID:4092
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5408,i,17218051159944509979,1410921604855403481,524288 --field-trial-handle=2828,i,2960675535100469609,15657186485120434660,262144 --variations-seed-version --mojo-platform-channel-handle=5304 /prefetch:14
  2⤵
  PID:6096
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6120,i,333053462360053911,14151126967881840718,524288 --field-trial-handle=2828,i,2960675535100469609,15657186485120434660,262144 --variations-seed-version --mojo-platform-channel-handle=6148 /prefetch:14
  2⤵
  PID:4080
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6120,i,333053462360053911,14151126967881840718,524288 --field-trial-handle=2828,i,2960675535100469609,15657186485120434660,262144 --variations-seed-version --mojo-platform-channel-handle=6148 /prefetch:14
  2⤵
  PID:724
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5380,i,1057977030954649023,759469211503709035,524288 --field-trial-handle=2828,i,2960675535100469609,15657186485120434660,262144 --variations-seed-version --mojo-platform-channel-handle=4396 /prefetch:14
  2⤵
  PID:1160
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4912,i,12489375286264489773,5608528736566736628,524288 --field-trial-handle=2828,i,2960675535100469609,15657186485120434660,262144 --variations-seed-version --mojo-platform-channel-handle=5320 /prefetch:14
  2⤵
  PID:2876
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4916,i,18411497031264698595,11890666040747954107,524288 --field-trial-handle=2828,i,2960675535100469609,15657186485120434660,262144 --variations-seed-version --mojo-platform-channel-handle=5092 /prefetch:14
  2⤵
  PID:4748
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5600,i,4675326160030180410,594263955957558393,524288 --field-trial-handle=2828,i,2960675535100469609,15657186485120434660,262144 --variations-seed-version --mojo-platform-channel-handle=5612 /prefetch:14
  2⤵
  PID:1012
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=5896,i,8480485280338985062,16793265990157179619,262144 --field-trial-handle=2828,i,2960675535100469609,15657186485120434660,262144 --variations-seed-version --mojo-platform-channel-handle=6528 /prefetch:10
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5020

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:5708

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:1568

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 e413e02b9e80ee8d76d52c1043fc32251e2d7634d4b2fbd970df9ace9d91831a
MD5 22959b3a06a842ac30237dd57e8a3801
SHA1 0b7c28071a592034aa2607038000f085c7bb6362
SHA512 644add9ab912ad7fdfc55bc7a1b84482c75cc9bc69a59d169bae63a0400619d999846ebbadb0ef2bd6d35c2bd08a5f07053b600874dd5dfcbda7e8f3076131fe
TLSH
T1A5D02BE476408A0CC980203335F6524092018910D801D1480040B325CC845C1257F0DF
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 8aaa68aad07ba45abe53bd513aa5f7e7b21bd1b29db6e1d5c1e0a79a5f4eb890
MD5 74012bbce5fada7634c1da1b567562b3
SHA1 09db27f38f27e35986cfd407b57f6f83c8fc59f8
SHA512 c1a6a98f972793c84274c29552107bfe07b775c7c8121e5fdf137ebf9a7cc3f4eb43fe9eadfc842e7b92ca7281bbcea3d660bdd8fc9adc56add068510c41e48d
TLSH
T1FBD02BE07640890CC980203335F75240920189108401D1480040F335CC845C1257E0CF
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 b312d4ab565e3aa2844a40cd0100ce64aa4b0820b9d354edf4e65fe18fa83f86
MD5 51e3da33f63a26a412fb25d8c123f33b
SHA1 ee175472936366ce25e42f90e88a149a4613e6d1
SHA512 b606156b054ccb03f1868e1dc0e4b155c884752c105557d35f0a1f97f788c9dd1b977418dcf8bc9b49a5962d6bff1517d4c3d43b373144f299c16dbffe2a5c0f
TLSH
T1E261535D63210EE3D7E5C5F192E0B48831F78C60450BAB3A4293ADF068AAF7851DC517
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe594abb.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe594abb.TMP
Size 3KB
SHA256 d8c1ce3556d2432513c16a1ed51fc37f3f80641db4a8e8fc6cf8ef6f5582175e
MD5 36621d2ef960a0ab7d958ccf89951311
SHA1 fe9b77867554716622853c354c7f60de6d102fbf
SHA512 49bcb400543ea3839358b4654de80455e988a6aeb179932e32e35ba9a9ad5da6117f5e4ddaf7cfa580b6db976d6ba19296633367817745c9ee510b28732c1c67
TLSH
T11B61515963210AE3EBE5C9F196E0B48831F78C60450BAB3A4293ADF46CAAF7851DC417
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

75fa50be-5d35-462a-964a-abf47cdbb783.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\75fa50be-5d35-462a-964a-abf47cdbb783.tmp
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 1KB
SHA256 e8c42e0df691eb38e9415e145a2a029d5f6026e86788ca089f640aadc00d0d9f
MD5 a39042e64f2311eedcec9014c85fa41e
SHA1 7caaaa40f9c69335093bad872638cdd5d67d5dde
SHA512 e022715e1b8f1e0737f676033bc1cc6867fd85577876a50812f4d72c03013134e609b0a8cea9d83d373305a4fb4e4f316bbd6b1f9c96b10d61ab08db852bf840
TLSH
T1AE217CF783B4957E9A1182F0EA08AF1FCF6D0411431C79AAC5E06D2793F34A2E041A9B
MD5 SHA1 SHA512 TLSH

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 f41127724b79b3e0851a87a481e8d84bcea967c6d1603b41d456329bf3ecb083
MD5 002d53f9bca5cf9f806579b60ffcf14d
SHA1 48230e7c080545517e6e770ee5e8d8a134a21d06
SHA512 a6e187f518fd8657ecf6f6da541021e9839a76911eb2bbd53d8f00284047af089d6a66611e3e336715e1b66cec0aa705c2903e0d9fb4da5f872c04103ac0fe3d
SSDEEP 192:sxRXrbE/fbsrZmprQ5yzoA8p4k/g6+WNIYn8UShGlGsIgDUJ:sxRXPE/fbsrZmOJ/5ITtG7k
TLSH
T18132D8166A68A83B9CCBE21DFB55BF93D2F9503260D05E58A6FC9A1C04E76DD220740F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 140306b2e93eeac28dbec17cbbb84d982d88a8e9c7d9aae44ee958a2dcd5ba9f
MD5 056f0bb32cb5c0098d5cae205ae99158
SHA1 45b8c5e070403df0ff9a5ed7de1ac4c3cc5a8854
SHA512 3b330ea8c53f9dfe86fc33159173f6635cbabb8dc2102dd15fc1a4d433a4b63f3557758ee3910b3ce132f4c54eb4f1223e790009bc8a302a5d2298ba465f1895
SSDEEP 192:sxRXrbE/fbsrZ/prQ5yzoA8p4k/g6+WNIYn8NwhGlGsIgDGJ:sxRXPE/fbsrZ/OJ/5ITYG7+
TLSH
T11932C6166A68AC3B9CCBE21DFB55BF53D2F9503260D05E58A6FC9A1C04E76DE220740F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 f0695a143663426bfeac6f895cdb0c19da0b1625a17dee348fccd572c5b2dfe6
MD5 f0fc84911a2f5934efcc52d067fb53ea
SHA1 d7e5953529f06d1a0c6acf938228b77f3fa3ec0c
SHA512 adbcbcfeec9215616cbf31b886cd0c1a1da51b41540b6e41d5b53f69452cdcb4d659aad5b54740db42323ed01898006dad0f83853fa91bf01d0bbe433c4aa95a
SSDEEP 192:sxRMrbE/fbsXZmprQ5yzoA8p4k/g6+WNIYn8UShGlGsIgIJ:sxRMPE/fbsXZmOJ/5ITtG7s
TLSH
T12632D7166A68A83B9CC7E21DFB557F53D2F9603260D06E58B6FC9A0C04E76DD220740F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 23KB
SHA256 c9471c34a8effdb63538ec3aee7f1e6d9a289b83c5574b8b1ca6bf6beabf7a61
MD5 e3265f1f154c04deef1069ce2abcf631
SHA1 3f7244b06fed1d970e63deb186b03b678b695871
SHA512 58d31748645d54de1f63659538d34df2003fa2ebdf3d797fc24b8a4405bd20a242c9b995a4df3eb23e80893058081eab6c9269f2f3bd770b5f075bc3b6895356
SSDEEP 384:wum8dzAfCtgoSFf6MKhOObJ+UoAYDCx9TuqZz0VfUCh7xbog/OVU494oRPzrohM2:wb8dz6Wgouf6M8F1+UoAYDCx9Tuqh0VJ
TLSH
T196B2DC3B604DCB7E5F800AADEC19AFDB6D5802C79A988D4447FE950C03C77EA511A4DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

OperationConfig

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig~RFe59e44b.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig~RFe59e44b.TMP
Size 3KB
SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
MD5 904e6e94a1d46374c8630cfd86cc729f
SHA1 e1d9c3f7813878acc6510d48d95b2bf48b2e1a0d
SHA512 081e2a26252860ff8d8f7a9d0378ae56f0cc50574d13d2a121afdf74284963747ef874a4d73b1df7774cd8570972f4f513eefe0a0325fd088556d5b1ba946712
TLSH
T1DB815C4FCC0CBE77ABAB6A719A35D6B2F79131EA94518A977F8C444EE3050ED0242E50
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 e9696913467891272dc2fde3fcf8463041e7d550597072ec510de012e37dc5f0
MD5 317e199711168b3cc04dc15c8c2430c8
SHA1 3acdd025d96b0559d3f5fccd74f6090aba0a30a1
SHA512 ac89cbb1189279119e92f54fb45f549b83da09eb1574b34c3a509073c65d31ace15e94d627d57bff9e7de51d78bbf020b013c9422a913f9a657621cf244e4881
SSDEEP 768:Nrv+4UNbd83ynPDZIO033ZNzc4ReyIsPaEB:Nbsba3Ztc44bsCEB
TLSH
T1D503BE32F828D977ACF69296B50775437EF8611B82C80A98C9DD2F4C0A4B5ED131F923
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 39KB
SHA256 548ea8b84bf7df270572c3adc8ebdc54ae5de202cbf34756bbe49fbe525827ec
MD5 49a8ecb69e9ae4173ea0cde88eb7b45e
SHA1 c1e23bef7d9d836bdd9136a14bc24533c19159ce
SHA512 b38356c16c6f39705e18e3014326c22e18cd9351ce5cf78fe4b9932b264d5358b552b2e216f8e736d6c44fe56f2466ce6cd808848373a6a8dc74303451607996
SSDEEP 768:vrv+4UNbds3cnlDZIO0338Nzc4ReyIs2aeVH1S5D:vbsbS3gtc44bsJEH1Y
TLSH
T10703CF32A868C977ACF69686B14775433EF8911B82C81ED4C9DD2F4C0A4B5DD035F923
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 40KB
SHA256 9571c1e599c602ebde4fac1a267168647ecc39cf732f01c1acf26c3955f4ffa5
MD5 01da25ad562e9d3336e128f6ac291521
SHA1 a9926093170fa3b13bb1ecc88342614a6b52737d
SHA512 20535494c239894a62baebcdd77b701ea8f0e895635747d1c3ec05fe16ce847c62fcc9acf4b3eaeea906ed550943423d3cea5b27077d0b0e49f4aeba1c64fd9c
SSDEEP 768:IF0rv+4UNbd/3cwgfnPDZIO033ONzc4ReyIsPaE8:1bsbR3Ytc44bsCE8
TLSH
T12C13AD33A868C97BACF68A96F60B3143BEF45157C1C85AA8D6DD6E4C054B0ED130BD63
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 535429eb3475ac240f5bd50b02a9dbfb8661651ec805173925d6c5e723c42f39
MD5 dc75eb8057d3674291aeb0fbd9a90946
SHA1 07e32a2a97aa3016295e200c1af53f4247eeb9f5
SHA512 d83c13ae518f3633a8e7341df4d93bde6647f5cff2af477e33881c61c2935113323a6ec40a9bb4ab24f3abe17a6732c0acdfeed5809dffacc6f9d4205a969dd0
SSDEEP 768:Orv+4UNbd83+nPDZIO033ZNzc4ReyIsPaE8:Obsba3dtc44bsCE8
TLSH
T16703BE32F828D977ACF69296B50775437EF8611B82C80A98C9DD2F4C0A4B5ED131F923
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 9629354876b0c76e4ad55dc3945a8d2715b01f5c44e2f619fecd70f6ebd8679b
MD5 9ccb87441c543a7aa85f50ae40540c46
SHA1 9cd7b2e07495083bbff3f32e8c39b2414bdde481
SHA512 e7b809dff895b8ab3b1df6929c9571d5124898c170154683f0dc5bbd80594dd04a45a6342fcd7688cce342e5819fc32d7e35ea0d4345278163ef014bc38f838e
SSDEEP 768:6rv+4UNbds3EHDZIO03SNzc4ReyIsXneVH1S5D:6bsbS38tc44bsXEH1Y
TLSH
T14903CE32A868D937ACF6A786B10775533EF8512B82C81ED4C9DE2F0C464B5DD131B923
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\metadata.json
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

memory/724-168-0x00007FFA83850000-0x00007FFA83D9B000-memory.dmp

Download

memory/724-178-0x00007FFA95B50000-0x00007FFA95B82000-memory.dmp

Download

memory/724-170-0x00007FFA966B0000-0x00007FFA966DB000-memory.dmp

Download

memory/724-167-0x00007FFA8B710000-0x00007FFA8B730000-memory.dmp

Download

memory/724-165-0x00007FFA87260000-0x00007FFA87324000-memory.dmp

Download

memory/724-173-0x00007FFA983A0000-0x00007FFA983FD000-memory.dmp

Download

memory/724-174-0x00007FFA7FEA0000-0x00007FFA7FF2D000-memory.dmp

Download

memory/724-175-0x00007FFA7FF50000-0x00007FFA7FF5C000-memory.dmp

Download

memory/724-176-0x00007FFA7FF30000-0x00007FFA7FF4B000-memory.dmp

Download

memory/724-172-0x00007FFA7F570000-0x00007FFA7F825000-memory.dmp

Download

memory/724-177-0x00007FFA93F40000-0x00007FFA93F4D000-memory.dmp

Download

memory/724-166-0x00007FFA7ED10000-0x00007FFA7EDEB000-memory.dmp

Download

memory/724-179-0x00007FFA963B0000-0x00007FFA963F8000-memory.dmp

Download

memory/724-171-0x00007FFA95AA0000-0x00007FFA95AE5000-memory.dmp

Download