349897b22cd043d3512b3d628cb287337aef1a248e548433acb995b48b0a0fe0

Analysis

max time kernel
149s
max time network
154s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
14/08/2026, 12:33

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
liesmich.html
Size 8KB
Sample260814-prp5dstbrd
SHA256 349897b22cd043d3512b3d628cb287337aef1a248e548433acb995b48b0a0fe0
MD5 618ea35fd4e46585d19ba25e973d20e0
SHA1 21fbd17c64344902ef52811a3bb04e469cf855b6
SHA512 78134fc0edfa09ed5a05c4b8d73aca3ac0015df465894caebc29c0c5a9bd4271deee2e06c01cea07f12d7da18c98cf53f1bd9c6a4571b73bba52703c8d9b2031
SSDEEP 96:PXcymUYkrqH4dojNFqsE7ui+Wb7LM/thTKvOCXlHoumrt9TxtPXiLuIiWXkZlq/w:PX9Ykrm3QfvLARAnU1qCQFXwuYdl
TLSH
T15C02B673F4C6532A9741F36571002D3E7236E1FFA38D171A40DBD2276A866F08EAD19A
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4812	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134311845699888534"	msedge.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1074038928-2032447174-945360078-1000\{EDA30A4C-37B2-4BD7-8B44-0959AB993646}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4244	msedge.exe
4244	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
2672	msedge.exe
2672	msedge.exe
2672	msedge.exe
2672	msedge.exe
2672	msedge.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
2672	msedge.exe
2672	msedge.exe
2672	msedge.exe
2672	msedge.exe
2672	msedge.exe
2672	msedge.exe
2672	msedge.exe
2672	msedge.exe
2672	msedge.exe
2672	msedge.exe
2672	msedge.exe
2672	msedge.exe
2672	msedge.exe
2672	msedge.exe
2672	msedge.exe
2672	msedge.exe
2672	msedge.exe
2672	msedge.exe
2672	msedge.exe
2672	msedge.exe
2672	msedge.exe
2672	msedge.exe
2672	msedge.exe
2672	msedge.exe
2672	msedge.exe
2672	msedge.exe
2672	msedge.exe
2672	msedge.exe
2672	msedge.exe
2672	msedge.exe
2672	msedge.exe
2672	msedge.exe
2672	msedge.exe
2672	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
2672	msedge.exe
2672	msedge.exe
2672	msedge.exe
2672	msedge.exe
2672	msedge.exe
2672	msedge.exe
2672	msedge.exe
2672	msedge.exe
2672	msedge.exe
2672	msedge.exe
2672	msedge.exe
2672	msedge.exe
2672	msedge.exe
2672	msedge.exe
2672	msedge.exe
2672	msedge.exe
2672	msedge.exe
2672	msedge.exe
2672	msedge.exe
2672	msedge.exe
2672	msedge.exe
2672	msedge.exe
2672	msedge.exe
2672	msedge.exe
2672	msedge.exe
2672	msedge.exe
2672	msedge.exe
2672	msedge.exe
2672	msedge.exe
2672	msedge.exe
2672	msedge.exe
2672	msedge.exe

Suspicious use of WriteProcessMemory 32 IoCs

description	pid	Process	procid_target
PID 2672 wrote to memory of 5040	2672	msedge.exe	84
PID 2672 wrote to memory of 4812	2672	msedge.exe	85
PID 2672 wrote to memory of 2468	2672	msedge.exe	86
PID 2672 wrote to memory of 2468	2672	msedge.exe	86
PID 2672 wrote to memory of 2468	2672	msedge.exe	86
PID 2672 wrote to memory of 4684	2672	msedge.exe	87
PID 2672 wrote to memory of 4684	2672	msedge.exe	87
PID 2672 wrote to memory of 3316	2672	msedge.exe	89
PID 2672 wrote to memory of 3316	2672	msedge.exe	89
PID 2672 wrote to memory of 3316	2672	msedge.exe	89
PID 2672 wrote to memory of 780	2672	msedge.exe	90
PID 2672 wrote to memory of 780	2672	msedge.exe	90
PID 2672 wrote to memory of 780	2672	msedge.exe	90
PID 2672 wrote to memory of 1264	2672	msedge.exe	91
PID 2672 wrote to memory of 1264	2672	msedge.exe	91
PID 2672 wrote to memory of 1264	2672	msedge.exe	91
PID 2672 wrote to memory of 2344	2672	msedge.exe	92
PID 2672 wrote to memory of 2344	2672	msedge.exe	92
PID 2672 wrote to memory of 2344	2672	msedge.exe	92
PID 2672 wrote to memory of 4364	2672	msedge.exe	96
PID 2672 wrote to memory of 4364	2672	msedge.exe	96
PID 2672 wrote to memory of 796	2672	msedge.exe	97
PID 2672 wrote to memory of 796	2672	msedge.exe	97
PID 2672 wrote to memory of 3356	2672	msedge.exe	99
PID 2672 wrote to memory of 2400	2672	msedge.exe	108
PID 2672 wrote to memory of 2892	2672	msedge.exe	109
PID 2672 wrote to memory of 1560	2672	msedge.exe	110
PID 2672 wrote to memory of 2504	2672	msedge.exe	111
PID 2672 wrote to memory of 2504	2672	msedge.exe	111
PID 2672 wrote to memory of 1324	2672	msedge.exe	113
PID 2672 wrote to memory of 1324	2672	msedge.exe	113
PID 2672 wrote to memory of 4244	2672	msedge.exe	114

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument C:\Users\Admin\AppData\Local\Temp\liesmich.html
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2672
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x260,0x7ffcbb38c188,0x7ffcbb38c194,0x7ffcbb38c1a0
  2⤵
  PID:5040
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1848,i,1527571369751516759,16944973423202500133,524288 --field-trial-handle=2256,i,11011472653917114111,8736120588811458638,262144 --variations-seed-version --mojo-platform-channel-handle=2320 /prefetch:3
  2⤵
  - System Time Discovery
  PID:4812
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1684,i,257480125226452574,16426188825412540453,262144 --field-trial-handle=2256,i,11011472653917114111,8736120588811458638,262144 --variations-seed-version --mojo-platform-channel-handle=2276 /prefetch:2
  2⤵
  PID:2468
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2540,i,6723362076171794497,13353373662973807191,524288 --field-trial-handle=2256,i,11011472653917114111,8736120588811458638,262144 --variations-seed-version --mojo-platform-channel-handle=2564 /prefetch:8
  2⤵
  PID:4684
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3460,i,17485378445103191213,12648302899073539384,2097152 --field-trial-handle=2256,i,11011472653917114111,8736120588811458638,262144 --variations-seed-version --mojo-platform-channel-handle=3516 /prefetch:1
  2⤵
  PID:3316
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3464,i,14305382029271485610,11233556087669413961,2097152 --field-trial-handle=2256,i,11011472653917114111,8736120588811458638,262144 --variations-seed-version --mojo-platform-channel-handle=3576 /prefetch:1
  2⤵
  PID:780
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4276,i,5858862084127748058,12534673352321804810,2097152 --field-trial-handle=2256,i,11011472653917114111,8736120588811458638,262144 --variations-seed-version --mojo-platform-channel-handle=4296 /prefetch:1
  2⤵
  PID:1264
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4288,i,14833641615241946158,2351236039777606487,2097152 --field-trial-handle=2256,i,11011472653917114111,8736120588811458638,262144 --variations-seed-version --mojo-platform-channel-handle=4396 /prefetch:2
  2⤵
  PID:2344
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5168,i,13120185193980624957,15029406440552436099,524288 --field-trial-handle=2256,i,11011472653917114111,8736120588811458638,262144 --variations-seed-version --mojo-platform-channel-handle=5204 /prefetch:8
  2⤵
  PID:4364
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3644,i,11064901973607329045,6635217392497978007,524288 --field-trial-handle=2256,i,11011472653917114111,8736120588811458638,262144 --variations-seed-version --mojo-platform-channel-handle=5212 /prefetch:8
  2⤵
  PID:796
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5580,i,9136651106921328403,9483602341173930440,524288 --field-trial-handle=2256,i,11011472653917114111,8736120588811458638,262144 --variations-seed-version --mojo-platform-channel-handle=5552 /prefetch:8
  2⤵
  PID:3808
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5580,i,9136651106921328403,9483602341173930440,524288 --field-trial-handle=2256,i,11011472653917114111,8736120588811458638,262144 --variations-seed-version --mojo-platform-channel-handle=5552 /prefetch:8
  2⤵
  PID:3356
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4396,i,12134579653939890303,7987117382154313706,524288 --field-trial-handle=2256,i,11011472653917114111,8736120588811458638,262144 --variations-seed-version --mojo-platform-channel-handle=5912 /prefetch:8
  2⤵
  PID:2400
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4496,i,18401255420994169974,2167889542105385486,524288 --field-trial-handle=2256,i,11011472653917114111,8736120588811458638,262144 --variations-seed-version --mojo-platform-channel-handle=5560 /prefetch:8
  2⤵
  PID:2892
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4364,i,11449887700050067901,14593955977478649741,524288 --field-trial-handle=2256,i,11011472653917114111,8736120588811458638,262144 --variations-seed-version --mojo-platform-channel-handle=4548 /prefetch:8
  2⤵
  PID:1560
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5252,i,15686809769400938791,15035131776071142810,524288 --field-trial-handle=2256,i,11011472653917114111,8736120588811458638,262144 --variations-seed-version --mojo-platform-channel-handle=5236 /prefetch:8
  2⤵
  PID:2504
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5708,i,17771736177579301410,7960950851340492313,524288 --field-trial-handle=2256,i,11011472653917114111,8736120588811458638,262144 --variations-seed-version --mojo-platform-channel-handle=748 /prefetch:8
  2⤵
  PID:1324
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1988,i,16525193722454487156,16249145197156919187,262144 --field-trial-handle=2256,i,11011472653917114111,8736120588811458638,262144 --variations-seed-version --mojo-platform-channel-handle=5220 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4244

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:924

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

blocklist

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\blocklist
Size 105KB
SHA256 e0424f12e2966d4edd61d48eb03e7a78e7aa9d384165acd4a8973fc664dca54a
MD5 7acb47b9e36d0b80e2fc9707e9c8e89d
SHA1 551a4ce1b41fc63afca9012e67ab4229c732feb7
SHA512 9b137ab83de648a2382112e33229e3ec6225fb81e794374fa123d6e7e13e4de7bc9858a11d08d360a0f72c10415e71a0f49f1cffe9e27deeea1ca3cbacdcc9b3
SSDEEP 1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P7K:fwUQC5VwBIiElEd2K57P7K
TLSH
T16BB3B931457E36BF26E93EE828CF1511B84F3912664895D4ABE1FE2C4845E68633CEF4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 85da5d101c008762046da9670ca95944217bbb1829e60a748f367ee4f9926b13
MD5 ef105d8d3e87a813544857290c28833d
SHA1 bfe7010cf80fb8cbcb9eeb5e0d0b551ece0b3134
SHA512 ae71c302652e2de890fca25723381f403f4f9ee51e2da6583977318de3e7ff00defb73b202e17a287def3ff618de86c0af96c0fca7729ef3efe0a4ba3cfdfc63
TLSH
T16FD0803377C9A100F6567375F413C7412F27057415868613A168C45CDC784C557C92C7
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 98eae6fcc56d922689f3a45ab65635857e6510c437555d4eae3a6cd68dff3acb
MD5 338a3c92e96cad1510815c958fc76de7
SHA1 e1234ace09aad728f9bde0798e2fb22ee82583de
SHA512 e29c9087bb4c9c94c8525a95c307117f14827336de29aa01f837bd02b05b3aecd1c1771970519a60972a1495e05b4f68ab34cf5e4ec9d7060f6383ac019c2ed7
TLSH
T17DD0803337C9A500F6567375F412C7412F2705741586C713A168C45CDC794C557C92C7
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 72a2eadb9df2bf9cb743f4ed93519a268cb22e6e7f30f1f39c566838b4287367
MD5 77e038688c7cc5b482a31d378336883e
SHA1 e76e4b68582456c44019b61c7f8946b42472f618
SHA512 4d8d024f0e82b0bf485b09162a8482db8587f1718698f102d3682ae4f4b90a18716a863d5b1e6ed8367996fccfc900bfb1928b1eb9a0b956d8112180fc9fc2aa
TLSH
T159713A2902FE039EF3222232F1D91A1834F3679B0E937D4E10A88F7C2532B348DE5809
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe58753b.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe58753b.TMP
Size 3KB
SHA256 f115a2767046983956a28d9a9f166ea846e3b071d2a321cbfcc7b50820dae7ff
MD5 798efd4dfd8c809fb6722b00eaf2b6f1
SHA1 23b2c8c76f7d86854ae645fba89dc7e2849ef2ec
SHA512 9e340e13ca837e44ea12b22d0f622e503a96613f22a8b4293bf0c916a5326353e68c9df366a99df85bb0f7c8c55491690d6c8f0162f435f60b88617c5a22c2d8
TLSH
T135712A2952FE079DF3262232F1D95A1834F3679B0E937D4E10A88F7C2936B348DE5409
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 949B
SHA256 5a0d19f55ccfa8970b89e50c2e7abbb19fc5e19597c04b39f83c360e41859ead
MD5 ffb882cb4f847a3c84d50e6106e9e714
SHA1 f0ce89dc2a0fbdf17683e6560699076a5b86797e
SHA512 46f9da78dbb9f1a63a79c9d6b1ab1105bd4356c73eb08f425f2887349d2868916a49be329b8a2dbf5189483907a7e08626ca021c7477f05ecddd3db42c4cfee6
TLSH
T1641190F3C3D595AE890156F05A24AE2BCE2D0615421C7C19C9D4EF67D3F3075E10255F
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 b9065781be6cbfb7270e2a6dbe037d48cc4038c3462b19f2e971a8169aa90a12
MD5 205b3561e2b98c4c35020146f2d486e2
SHA1 024a36a6a448f4b03572ba9df7b1a424d4fd6bd8
SHA512 e606a42291eb35a69de800c67830afedd775e99fc256f7b2915925ab3f081c96733e64ee611901605b3f760ad21aa3d8320b8e7bf5ff3a2d7c016859faedeb9a
SSDEEP 192:sxZoRQyM/jK1Ml8Mkd/fcsnJzIdpdIHW6+WNGY4wNCMIgrJ:sxZoaMd/fcsnJsmHbGy9
TLSH
T1B442E8116A3469B7CCDBD209FA557F93E6F90473A2900D44ADFCDA1C04E6AED221782F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 ba5cba361f6f27c2affcb4caaae7f2cd3718f58090f08b846190d0c617621551
MD5 b7efe511037da5d3f45c9f2e1d4b40b2
SHA1 1b7618169f9f35a44af5b4161730de46567c518a
SHA512 acf5a40fa71dda893f7d528b088ea47cde7d8b91bc48ff36e121cdaf683eee2163dff133c316b4cf0315ffcadb210cae9faa537712cf641648573ee954060434
SSDEEP 192:sxZoRQyM/jK1Ml8UQDYkd/fcssWzIdpHIHW6+WNGY4BykMIg5+J:sxZoaq3d/fcssWsoHbGIQ
TLSH
T18E52E8116A3459B7CCDBD209FA557F93E6F90473A1900E44A9FCDA1C04EABED220782F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 30KB
SHA256 e61f52c6966b845794b17cecb56c25ab9f740e6716c5cb0bd0282628765b8d2e
MD5 0f10f292b97d823c8c98f1abc51450b0
SHA1 4eaf76106cf7bddff44c36778ad9aa0224665584
SHA512 3fcd7075677053dbfda43a48a51a4ae44107d27fb55428e7a4f426d98cefe72ac4097988a7df61753e1837af7833860013427500f7274082e28e45176488a98b
SSDEEP 768:p98iJPNWvx76r8F1+UoAYDCx9Tuqh0VfUC9xbog/OVsALl6opduroTkB3Un8:p98iJPNWvx76ru1jahALocdlk3U8
TLSH
T176D20B3B680CCB7E4F844E9CEC266F966DD801CB5B988D5447FA880C03C76EA51279DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 9a4cca14e275a86a0d32b7cf4339a6e7f15444f24aeb7a63356e266d820e0e87
MD5 d1daf37d5a91374060faae98488ef2ef
SHA1 f4125f018fa8d08b23b05e1e188aa28e05efd006
SHA512 2c0ae711bc8bdb2b90aa07a19fcb29fe5312e45c8d79ad3f28273497dbd452b8e9b181bc8dc5031e69318236e2ce596de8a2faa2b5dbfdcbff0dc53a7d2c7872
SSDEEP 96:K0YwKlqqCy8Knqh2/iWQ44+WIBlA2+KYLAc+0e25MGfKz:CvnY2/iWQ44lIBm22LAcxe25MGfS
TLSH
T19991B75774BB02517D7F250892958B169B83B6B33208E42B37B841724EABE344CFD5DC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 20KB
SHA256 2ed81a849e1a9361dc0f108257481f854f94925dbd43b09d3639a82933d643a5
MD5 d969961b07dd75f0a7f83c23373e8d50
SHA1 43f06aa94bf3f17d90c9979cad61ab5e852618fe
SHA512 7547ca8b10d4f9be35ad24f95bf774201a069fb0d0a06c2b22c33911501a7f379393f4e9f97ef720790ed4e0736cf133a067e1184963423c27718f8277d691ca
SSDEEP 384:sZcIVsN5GiwDI7Vvkywmf6nU1VOOPrXLpe8C/9tM:6VHDOfX6nU1VOi9PUtM
TLSH
T18292AE7168786C676DF3FA46F94637139FF88067E7C82F8496ECA71C05DA5980307826
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 20KB
SHA256 2474ecb6bdffbfa668330d21e4a51584a95b491ffbef0e2b7a62e9dfe609b969
MD5 825a942207524fb1463bbe54b1803f43
SHA1 0e3faddf617e3d7ddad8035b8ea44596226e2f58
SHA512 bcda2e50c2708f1dbb2a722ba6e5b0dc299d62662a388aaa1222b5d160ff95299eff70918d1b3ebdcfa4c0574b3220b9ec0e519a50fe66b4702ff7ec87ae7263
SSDEEP 384:ZZcIhsN5HiwDI7Vvkywmf/1VOOPrXLpe8C/9tM:xhaDOfX/1VOi9PUtM
TLSH
T1EF92AE71A8786C676DF7FA46F84636139FF88067F7C82F8496ECA71C05DA1980307826
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 669033e1a1babecedf4b01403e0bfe0ef606258da41484fe293c1974f8cc7498
MD5 abcb69e0861e8a2a13ce5671f9b785c6
SHA1 06e9691f06b84691fe167a8635c7e4f9ced654ee
SHA512 2b210397462c9a184a3081a891edac01ab8eb91a9987d139933a67cb36f20b2226cfa3c351b012b77bb632b7e14a28aa982c681242bcb11ac41c64710197589b
SSDEEP 96:ZqONkrwQsjpfmUTmDK5ih/cIPURHl8h4otop5wK5DwCBhPwivh50xy0SFYKNAxOm:gONw6kDfQmiUyPlZ903iow+Qib90oU6
TLSH
T1DA02D83568786CBB8EE3AE49F5463B275FA4116BEAC52F85DAE81B1C00D765C1303826
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 20KB
SHA256 3015084b5507ac990cd7b692c7f164179333e0087b249cf8d0093aa4ad273c70
MD5 30407f42b714dce44ab6d4747f28e6f4
SHA1 5c8a3eed879234251c616d06e6c57cfe3d9fe8c2
SHA512 0f898fd4d40a105547d8d0196031271daa0204470c29715228920724b310f8534fb398b5061850a9840b0b990be0ac5b7af8fb7755f77912ac2c413f844933d2
SSDEEP 384:dZcIhsN5GiwDI7Vvkywmf/1VOOPrXLpe8C/9tM:FhHDOfX/1VOi9PUtM
TLSH
T15892AE7168786C67ADE7FA46F84636139FF88067F7C82F8496ECA70C05DA5980307826
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 b46da80ee71e08e66d774aede6a0f604f5213b836c048d43b8631eb59a20f9a7
MD5 bc1b6ab83fd711b5eafb5d99918812e9
SHA1 2dc785e00be2478c61b3696b8d4c24f59b887727
SHA512 4eb09b023580ac3dc3d0aa73e142adea5a75fecdd77f078bc65d808c453f1614bd5c614f11ae552638e86f5d13032bec8c9ac449ec593fb33749098eb5fc722f
SSDEEP 192:LON06k/QmiUyElt903iowmcEJ7cRbrqkVU6:LON06cFt9ywmfG1VU6
TLSH
T1EF123A3268686C7B9DE3A946F44736139FA5816BDBC97F80D9EC261C01DF29C1307826
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

5592fd7a-5825-460b-b3ba-28a44c968600.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\5592fd7a-5825-460b-b3ba-28a44c968600.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 a7859710275a98efaa1f062f62cd738872946a0139a6a5f119fd86d56aaf4da5
MD5 659c768b50b170ebaccc3e7e8cf31a32
SHA1 f13525965e77579226c36ee7e456b97077b0e6c3
SHA512 dca1722dd5fe22cd214e00a4af0ab6ca9fd07b16e73b79c1bbd749f981ac3279e44f50a0892724c618b7259142ceb563720f8b7962ecc7bca38e987a42637ccd
TLSH
T1D0412B68ABF91148B3776F569BF6A86D447BBD372F07D49E10010E4F4662B40C8A2737
MD5 SHA1 SHA512 TLSH

Submit Download