6df59ec0f507f6b16def9232d9f2647c72c9019afdb9781ed12203db2a1d3c0f

Analysis

user interaction
yes
max time kernel
148s
max time network
151s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
13/08/2026, 00:14

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
view.html
Size 120KB
Sample260813-ajftesv1fs
SHA256 6df59ec0f507f6b16def9232d9f2647c72c9019afdb9781ed12203db2a1d3c0f
MD5 f0b2227ae25007908a7d140b9cac4e4e
SHA1 82555e804c3368a8b20d010204a13f474aaf1a8a
SHA512 35d26e7352f652be0dba18ec0edc16400d4681cc398858a6013549eb397c7481391d856e2dfad848fbf20bf0cf26e9fd0f34763ac17bec23b465538178eace9d
SSDEEP 1536:JEVVOzJa/KiLla5iRDCS3P02dR6U1Gh2dR6U1Gj6y:uQl
TLSH
T1C0C3736202119CFDEFF744A3608A1D563E5C1177A3925037F3DD9EA92B974AB022837E
MD5 SHA1 SHA512 SSDEEP TLSH

Score

6^/10

discovery

Malware Config

Signatures

Contacts third-party web service commonly abused for C2 1 TTPs 7 IoCs

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Web Service

T1102

flow	ioc
104	drive.google.com
34	drive.google.com
35	drive.google.com
38	drive.google.com
54	drive.google.com
55	drive.google.com
66	drive.google.com

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
2512	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134310536813286522"	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-3989226554-2204910950-1522900112-1000\{AE0F2DDA-A7A6-4246-88D7-0266168E9EB8}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1368	msedge.exe
1368	msedge.exe

Suspicious behavior: LoadsDriver 1 IoCs

pid
4

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
3728	msedge.exe
3728	msedge.exe
3728	msedge.exe
3728	msedge.exe
3728	msedge.exe
3728	msedge.exe
3728	msedge.exe

Suspicious use of FindShellTrayWindow 33 IoCs

pid	Process
3728	msedge.exe
3728	msedge.exe
3728	msedge.exe
3728	msedge.exe
3728	msedge.exe
3728	msedge.exe
3728	msedge.exe
3728	msedge.exe
3728	msedge.exe
3728	msedge.exe
3728	msedge.exe
3728	msedge.exe
3728	msedge.exe
3728	msedge.exe
3728	msedge.exe
3728	msedge.exe
3728	msedge.exe
3728	msedge.exe
3728	msedge.exe
3728	msedge.exe
3728	msedge.exe
3728	msedge.exe
3728	msedge.exe
3728	msedge.exe
3728	msedge.exe
3728	msedge.exe
3728	msedge.exe
3728	msedge.exe
3728	msedge.exe
3728	msedge.exe
3728	msedge.exe
3728	msedge.exe
3728	msedge.exe

Suspicious use of SendNotifyMessage 16 IoCs

pid	Process
3728	msedge.exe
3728	msedge.exe
3728	msedge.exe
3728	msedge.exe
3728	msedge.exe
3728	msedge.exe
3728	msedge.exe
3728	msedge.exe
3728	msedge.exe
3728	msedge.exe
3728	msedge.exe
3728	msedge.exe
3728	msedge.exe
3728	msedge.exe
3728	msedge.exe
3728	msedge.exe

Suspicious use of WriteProcessMemory 36 IoCs

description	pid	Process	procid_target
PID 3728 wrote to memory of 4760	3728	msedge.exe	89
PID 3728 wrote to memory of 5024	3728	msedge.exe	91
PID 3728 wrote to memory of 2512	3728	msedge.exe	92
PID 3728 wrote to memory of 5024	3728	msedge.exe	91
PID 3728 wrote to memory of 5024	3728	msedge.exe	91
PID 3728 wrote to memory of 5988	3728	msedge.exe	93
PID 3728 wrote to memory of 5988	3728	msedge.exe	93
PID 3728 wrote to memory of 5604	3728	msedge.exe	94
PID 3728 wrote to memory of 5604	3728	msedge.exe	94
PID 3728 wrote to memory of 5604	3728	msedge.exe	94
PID 3728 wrote to memory of 4312	3728	msedge.exe	95
PID 3728 wrote to memory of 4312	3728	msedge.exe	95
PID 3728 wrote to memory of 4312	3728	msedge.exe	95
PID 3728 wrote to memory of 3416	3728	msedge.exe	96
PID 3728 wrote to memory of 2312	3728	msedge.exe	97
PID 3728 wrote to memory of 3416	3728	msedge.exe	96
PID 3728 wrote to memory of 3416	3728	msedge.exe	96
PID 3728 wrote to memory of 2312	3728	msedge.exe	97
PID 3728 wrote to memory of 2312	3728	msedge.exe	97
PID 3728 wrote to memory of 4228	3728	msedge.exe	99
PID 3728 wrote to memory of 4228	3728	msedge.exe	99
PID 3728 wrote to memory of 4228	3728	msedge.exe	99
PID 3728 wrote to memory of 4864	3728	msedge.exe	100
PID 3728 wrote to memory of 4864	3728	msedge.exe	100
PID 3728 wrote to memory of 4864	3728	msedge.exe	100
PID 3728 wrote to memory of 4924	3728	msedge.exe	101
PID 3728 wrote to memory of 5088	3728	msedge.exe	102
PID 3728 wrote to memory of 4924	3728	msedge.exe	101
PID 3728 wrote to memory of 5088	3728	msedge.exe	102
PID 3728 wrote to memory of 3692	3728	msedge.exe	104
PID 3728 wrote to memory of 1904	3728	msedge.exe	108
PID 3728 wrote to memory of 5804	3728	msedge.exe	109
PID 3728 wrote to memory of 3076	3728	msedge.exe	110
PID 3728 wrote to memory of 2612	3728	msedge.exe	111
PID 3728 wrote to memory of 2612	3728	msedge.exe	111
PID 3728 wrote to memory of 1368	3728	msedge.exe	113

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument C:\Users\Admin\AppData\Local\Temp\view.html
1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3728
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x260,0x264,0x268,0x25c,0x2dc,0x7ffe51fbc188,0x7ffe51fbc194,0x7ffe51fbc1a0
  2⤵
  PID:4760
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1528,i,3804138589481305606,7921623803649950570,262144 --field-trial-handle=2100,i,18446503561521099600,4341384346259590422,262144 --variations-seed-version --mojo-platform-channel-handle=2096 /prefetch:2
  2⤵
  PID:5024
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1860,i,4128251173896806256,15222446344549957380,524288 --field-trial-handle=2100,i,18446503561521099600,4341384346259590422,262144 --variations-seed-version --mojo-platform-channel-handle=3244 /prefetch:11
  2⤵
  - System Time Discovery
  PID:2512
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2232,i,11600065977845619529,3885890148528345216,524288 --field-trial-handle=2100,i,18446503561521099600,4341384346259590422,262144 --variations-seed-version --mojo-platform-channel-handle=3424 /prefetch:13
  2⤵
  PID:5988
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3364,i,15569414293869932425,1396783990719371879,2097152 --field-trial-handle=2100,i,18446503561521099600,4341384346259590422,262144 --variations-seed-version --mojo-platform-channel-handle=3552 /prefetch:1
  2⤵
  PID:5604
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3368,i,9751625827995820868,8604915576999863202,2097152 --field-trial-handle=2100,i,18446503561521099600,4341384346259590422,262144 --variations-seed-version --mojo-platform-channel-handle=3616 /prefetch:1
  2⤵
  PID:4312
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4276,i,2811869205581639220,3702765391915609850,2097152 --field-trial-handle=2100,i,18446503561521099600,4341384346259590422,262144 --variations-seed-version --mojo-platform-channel-handle=4308 /prefetch:1
  2⤵
  PID:3416
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4300,i,11666562251734777238,3746803993449197121,2097152 --field-trial-handle=2100,i,18446503561521099600,4341384346259590422,262144 --variations-seed-version --mojo-platform-channel-handle=3356 /prefetch:9
  2⤵
  PID:2312
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=5384,i,17301428011830011836,6518772121103312800,2097152 --field-trial-handle=2100,i,18446503561521099600,4341384346259590422,262144 --variations-seed-version --mojo-platform-channel-handle=5416 /prefetch:1
  2⤵
  PID:4228
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --always-read-main-dll --metrics-shmem-handle=5508,i,1097967509524298871,2770279764831435600,2097152 --field-trial-handle=2100,i,18446503561521099600,4341384346259590422,262144 --variations-seed-version --mojo-platform-channel-handle=5480 /prefetch:1
  2⤵
  PID:4864
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5528,i,1702998631753421612,12006355367156855323,524288 --field-trial-handle=2100,i,18446503561521099600,4341384346259590422,262144 --variations-seed-version --mojo-platform-channel-handle=5488 /prefetch:14
  2⤵
  PID:4924
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5540,i,530617600562880581,14984305446687071707,524288 --field-trial-handle=2100,i,18446503561521099600,4341384346259590422,262144 --variations-seed-version --mojo-platform-channel-handle=5660 /prefetch:14
  2⤵
  PID:5088
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6108,i,15934464049731105334,758241495558651410,524288 --field-trial-handle=2100,i,18446503561521099600,4341384346259590422,262144 --variations-seed-version --mojo-platform-channel-handle=5952 /prefetch:14
  2⤵
  PID:4480
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6108,i,15934464049731105334,758241495558651410,524288 --field-trial-handle=2100,i,18446503561521099600,4341384346259590422,262144 --variations-seed-version --mojo-platform-channel-handle=5952 /prefetch:14
  2⤵
  PID:3692
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4652,i,11236443013087980812,4774203209893428464,524288 --field-trial-handle=2100,i,18446503561521099600,4341384346259590422,262144 --variations-seed-version --mojo-platform-channel-handle=4428 /prefetch:14
  2⤵
  PID:1904
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4640,i,10266280428886632650,12916661749264103681,524288 --field-trial-handle=2100,i,18446503561521099600,4341384346259590422,262144 --variations-seed-version --mojo-platform-channel-handle=4632 /prefetch:14
  2⤵
  PID:5804
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4644,i,6670596818958931006,18103749727574501968,524288 --field-trial-handle=2100,i,18446503561521099600,4341384346259590422,262144 --variations-seed-version --mojo-platform-channel-handle=4648 /prefetch:14
  2⤵
  PID:3076
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3036,i,7818568855704857284,799018090492299663,524288 --field-trial-handle=2100,i,18446503561521099600,4341384346259590422,262144 --variations-seed-version --mojo-platform-channel-handle=4660 /prefetch:14
  2⤵
  PID:2612
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6664,i,3977966393791718741,64739130862341691,262144 --field-trial-handle=2100,i,18446503561521099600,4341384346259590422,262144 --variations-seed-version --mojo-platform-channel-handle=600 /prefetch:10
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1368

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:5780

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:5020

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 7f7f7efafb9f87082470af84df3b906033b9d533fb7a188458a4e181362f2170
MD5 8af1f60999c332d8cf9a392cd968a81c
SHA1 93834a1f070ff24041a0deb17d95d868998c98ba
SHA512 95d5c6b0fed3c3dce459178eafa2e9fa13b06caf50a5b294d66ecf16bf91357eccebec57e01d50e054232862c252fc80f7300e865318ec24078f9288a88c63d4
TLSH
T17BD02B206A444A4CCDC0B03064A2EA18E2104135680013C44001B06988901830B970DF
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 5e34bc4625bf22507150f49d8c28444bda8222ea36c2a7d431bbdaae5c134a9d
MD5 e1ae04b3e73ad5ac4854b3b71e22d4d3
SHA1 221461b4f2d9e84e2f881b5a79edfef3705178db
SHA512 58529610d3f5dd7778bff3b81dd8abd9d79702eff78583d0294f3999089de0bbf84f0abad703269c0988835522b1d8d48e9f3c65472a409c5868fc3547c3fb1b
TLSH
T138D02B206A54494CCDC0B03464A3EA18E2004135140013C44001F07988901830B970CB
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 1KB
SHA256 fc1c803421be74f171aa1af0857415d6ac19e16446f83aa4ce325ee2306c629a
MD5 98e41b9adab33ac56d26879e14af243a
SHA1 df3b1cfb1d876626e8599d678a90135e871363f6
SHA512 5b3d0c11c0cf00748f3c86fecc7986cab53f960080e34bc6619c0fa644aff5970883ba082eb7bf0d4b1d5555220f2638353e141998f26ae0a6285bebd53f2894
TLSH
T16C21339443273CE1E7A666F13DFEFD397234989D430F2ED0C141A9784AEE79015A2D25
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 6KB
SHA256 6418dd867ffc99b3efc91015c89fb75e9ed8536410baaf64cf0e4af2c3ed9cbd
MD5 99d2674d0ccdf82f16cd5ef5854f9e03
SHA1 2e25845fae5330ecc189870535a67e4f45c9bf6c
SHA512 43a1f6fb06cc2903229a8f41b5557ac7a21c7a409c154973ec08d79e1da8a042ff241673b6eaba1bb5c9bf2e23df5fcff0964b340ecea32f8d8fb8ce0edfdcc4
SSDEEP 192:DaWNLt4y3yUHkgwiPVaZa2L8EpidhTiklI67NEFIk:DaWNLOOREviPVaZa2L8EpiPTiklIoNEB
TLSH
T10AD18CF7C6D8877E882156F09B257E1ACD2D055A422C3C568DF8AF5F63E1471D2022AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 566b9f3c0747d60e81f5d82168fa75558dffa3b1b5c6a64aef8898ff0c5baf94
MD5 49cdc6c0afd7b9a589d91536b8d9a594
SHA1 1fee1d87f5862bf7e2ac91f92cb6cd1504833150
SHA512 ebe9dda084be62e379ad924b9b33837cffbd8104a638bb6fa059ba157b744beebabe4f302dbfcb443d62ff1432b1e8dc8b2c8fb4849e7c92a96fbf7fcbee90a0
SSDEEP 192:sxR2RabM/fiszaaHm2Sm7aAHzoD8p4a/g6+WNIY3B2XzGNIgIJ:sxR2GM/fiszaa2EP/5IAvs
TLSH
T13132B7156A68A93B8CC7E21DBA667F53D7FD503261D42E48FAFC9A0C04E66DD120780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 2c85429af6900075c588d9eefe801da0b5465fc715dc25b15aaf84bb25209b05
MD5 14764f7b29d4cb87640d74f076c32258
SHA1 53ac81f5cca8b4d4a9c96a19d34901f9a5df7389
SHA512 8829c7a1ce885ca20c9ec9a0401946813835f4cbd3074b74e2b7bf31f5c23bf79ba1e10d0d0c3fd3cac73322dd9ca8a341a3e0671d1280697aa89d180e6182e2
SSDEEP 192:sxRpRabM/fisda2Hm2Sm7aAHzoD8p4a/g6+WNIY3DvzGNIgDtJ:sxRpGM/fisda22EP/5ID7
TLSH
T19442B6156A68A93B8CC7E219BA667F53D7FD507261D42E48FAFC8A0C04E66DD120780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 9b89bcc231892b807fef44959f83a0d2dcd2d98f82f6fbc8ebd504e2bb21d05a
MD5 5040ad603880e4bf00d67e0dc80f6ad2
SHA1 6f47e24dcc1517bd0fede66897b0426ae4807add
SHA512 68b86b1ada03d6b4dffae286b3081059fbe00992501fe4441aefeb38b150fa2116c77c17207902b21211255034a7f323425d73f7529489193b94868e32f78d15
SSDEEP 192:sxRpRabM/fisdaaHm2Sm7aAHzoD8p4a/g6+WNIY3B2XzGNIgDbJ:sxRpGM/fisdaa2EP/5IAvR
TLSH
T12042B7156A68A93B8CC7E219BA657F53D7FD507261D02E48FAFC9A0C04E66DD120780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 23KB
SHA256 a2511ad28d19f898ad7d18d68f9ef10c1fd7b2b5ac62d707603b621eb552d88c
MD5 51b52c21bcf43fff7c4ec3b39689032b
SHA1 3d3b2dd4c611b060d97bec1e2f69bcd2ac15a868
SHA512 777ff0376c6fff463a72f1e1c8ac7a282865ad2535749185119cb3fc533d4484df81cb86b77c6227fc2981d0e853a65daa7f4a607968604bbf95545df4acc67b
SSDEEP 384:GMgEbt2fCtg0+FfKsKhOObJ+UoAYDCx9TuqZz0VfUCh7xbog/OVKO9W+RTiroOLh:GTEbtkWg0CfKs8F1+UoAYDCx9Tuqh0Vb
TLSH
T169B2DA3B600DCB7E9F804AADAC59AFD76D5802C79B588D4047FE990C02C77FA911A4DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 cc25fe6bbdd4c6081ddced6bc63e7b3ced8ae7aea38ecde87a2cc600c3978190
MD5 f8267e53a243b82cac9e8ab3ac98d13b
SHA1 43167d7349f6afc8678533b1ec3cc1065cdd16d1
SHA512 3f15fd953629f51fe75d1220f168ae9e98c6f95e0cfb334a2caeb18b1fbba4b47dd562414049d493362ff61689f3bb8cb4f6088354d2f6a91702747b2fb1015a
SSDEEP 96:KR1i7PF/DnWrw+gXnK4mgpnct1o7zsHpm3zBj3TWH0ig7TK4Kg1Tc5xMv3qHCHul:C1i7PF/DWrwfX9mgpct1o7zsHpm3zBjE
TLSH
T17291E355713B0341383DA94D90BAE42FD6C170A73068A52B3BA915AB4F66F038DFE8D9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

OperationConfig

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
Size 18KB
SHA256 d675bad1a758b07f1ed431a7812bf9fd82a0134557a9f1479faf96798a2a9d7c
MD5 f18b79a3435844f3cd10f1b52c52502d
SHA1 686226dff62991217fcaf2118b30364ed5b08220
SHA512 203b436d074f1f469ce6afb478f21e5847cb9adeecc4318aacd5ca131357810be9a8992d7737bd36a754ccc8f35273e30b64a8a51eacd17024779ac32e0ed767
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/uP:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbA4
TLSH
T15482751CC52C7E3247C92F7D6A2F9D727ACA30CA7081459D798CC69DC31B06DA58A2BD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 35KB
SHA256 939b090cfe67acb0afd60406da2a6adfa387a7fd3cafcd524bc8b73a7a9141c7
MD5 24b328ee2dccb29aff16d2a187ab74da
SHA1 799f20abdb73e5cf9fc911d318d1b21ca0ec0677
SHA512 c4e438ec58ae33295549dc3f9a6a042fabeabe96eff5732ccb3456df507483966c3e610dd845754a17ae34680dc9735285a109782baa09744bacb3e17a53b387
SSDEEP 384:gZcIV38NeCpmsFSfpYucHGfd+UJfRXOVyS5ffEufE09vShCiDBTayppFJlmqJrYo:eV3ymxac+wfZOZfhfXvShCQRhPi9PFq
TLSH
T101F2C0B0D8B469735CE6D245B7462B03BEE96173E9C85B44D9DC8B0C01C37AE171B836
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 cac2a7ecaa920b69209ec3f98a8b13325c9ffc78db08c6e2855b0f655accf957
MD5 a5c7c7573052a952c61442a9a450c94a
SHA1 66b15bd073f3ec78102cdd13bbc401ff6242e932
SHA512 47e95f57a859613d92675f6a151436a558ff66f48ea40a9ef26b504c7f1adcd624ce6f7849d81732e3784863a086ca149c27ed18812eb8301d52aff821a91fc7
SSDEEP 768:OFQB3Rwgcmxac+wfZOZfhfovShCQRhPi9PFq:lB39awfOfhfovStPP
TLSH
T1AA03BFB1D8A499779DF6DB85B74A2B03BEF952B3D8C89744E6CC890C01D36AD130BC25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 41KB
SHA256 b777e0120248b9849342d4c6cce1903131b94d7b3ffd716eb47c975b16504917
MD5 34749e651fc920aaaf527fa11bd31959
SHA1 733ef87405ba6a1f7a65c9a287af38ff5f596f17
SHA512 990d20d1034cbba566861820c8267d3419d0f9adf1a038aeef5de25105ad2e6f10631b838bc101df4d22c5cdabaf2c0e1878fb7423f142db4452863c4158213f
SSDEEP 768:Zrv+4UNbdy3JmCac+wfZOZfhfXvShCQRhPi9PFB:Zbsbc3EFwfOfhfXvStPI
TLSH
T1B113CF71E978A9739DF29255B2466B13BEE86173D8C80744DACC4B0C02D36AE271FC26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 39KB
SHA256 3b5da0d0dce9ebb138fdd89cf5528312982b02f966324222b891ba1d0537e5c5
MD5 aae3e40584d9267114de180840b2433d
SHA1 c86168d67d811dea856bfa6b419990010aa95607
SHA512 4ef0ac94403ac3e62dd1077680b17298bc88ebb1c090658e7efd1b3c05095dd0474ee14d00c3afcde64a74dcf3f64fcf468b598e1a292856e0d58eb8ebe86be8
SSDEEP 768:3rv+4UNbd43iMc+wfZOZfhfOvShCQsh2bwWV:3bsbO3fwfOfhfOvSK0wO
TLSH
T19603CF71E878A9339EE7924876467B53BEB952B3C8C54744DACC0A0D019369E330FC27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 4a35513d41910b024af7c0fdaae6d5645a0d7e1a9b27c0b983ac277639e99bfd
MD5 8fdbf89a3915b40fb33b45661b0f359f
SHA1 6e4e49a4f31ec15ab9eb8367597c06c2e89b00c1
SHA512 1d763c2ae477a6156d62b54d2748037665cb8deac27e8294f8c27dcf14378e339e054399ac886cac6773df7ed002b519993943c48308cc0a1582357fa06518ce
SSDEEP 768:Rrv+4UNbd43Ivkc+wfZOZfuvShCQtW2bwWV:RbsbO3IWwfOfuvSS0wO
TLSH
T14E03DF32E86899339DE792487646BB537EB861B3C8C54744DACD4B0D018369F330BC67
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ab4158a5-1ce7-4559-b01c-154f590c4e65.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\ab4158a5-1ce7-4559-b01c-154f590c4e65.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

fc919f2a-8d01-4b17-935b-afc4af5de967.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\fc919f2a-8d01-4b17-935b-afc4af5de967.tmp
Size 35KB
SHA256 589819fc5b89b634cc09c896e5ea6d86564470d9c3546ee715bd8c7bd61420b3
MD5 967c99d00773e35e2e887238e747acff
SHA1 2a1fee5dc53ebecc3aebca54d9f14697d8290430
SHA512 bdcd4c8a4a605d75d41cc0e934f10820858832987d522c1e5d2b813b2fa68ba544146c54954695cfbc28b4092de7b560543045308c5654cd2db8b5c8a062c135
SSDEEP 384:nZcIV38NefpmsFSfpYucHGfd+UJfRXOVyS5ffEufE09vShCiDBTayppFJlmqJrYo:PV3Jmxac+wfZOZfhfXvShCQRhPi9PFq
TLSH
T10EF2BFB0D8B469735DE6D245B7462B03BEE96273E9C85B44D9DC8A0C01C37AE271B836
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download