0e3df7e8abedbf3619ed39c5ee87a9299b7f03ab61a9ec9c525912ab6800f7c7

Analysis

max time kernel
148s
max time network
167s
platform
windows11-21h2_x64
resource
win11-20260513-en
resource tags

arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
14/08/2026, 19:25

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
resources/public/index.html
Size 383B
Sample260814-x49css1scs
SHA256 0e3df7e8abedbf3619ed39c5ee87a9299b7f03ab61a9ec9c525912ab6800f7c7
MD5 e582b9106fb430459c697d4c5a519c25
SHA1 418242c0ee36e592982e3569c6bbb78f7274546a
SHA512 dcc2c76bda2f6567f90161911ab49600cd7896ee5607a4bfb842439189745156941c20d32b09d64b2554f1184b413f0b9f7399ec10013452cd45b791a39c96a3
TLSH
T112E0DF43C0E18809D32182700CC1F15D4BA2F6DBA7CA6D49B98A20898FC0B90CED72E9
MD5 SHA1 SHA512 TLSH

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
3832	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134312094467370568"	msedge.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1636999435-3883760687-346127294-1000\{125DC3F8-9D9B-4CEC-8451-C4F543D73812}	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-1636999435-3883760687-346127294-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4500	msedge.exe
4500	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
856	msedge.exe
856	msedge.exe
856	msedge.exe
856	msedge.exe
856	msedge.exe
856	msedge.exe
856	msedge.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
856	msedge.exe
856	msedge.exe
856	msedge.exe
856	msedge.exe
856	msedge.exe
856	msedge.exe
856	msedge.exe
856	msedge.exe
856	msedge.exe
856	msedge.exe
856	msedge.exe
856	msedge.exe
856	msedge.exe
856	msedge.exe
856	msedge.exe
856	msedge.exe
856	msedge.exe
856	msedge.exe
856	msedge.exe
856	msedge.exe
856	msedge.exe
856	msedge.exe
856	msedge.exe
856	msedge.exe
856	msedge.exe
856	msedge.exe
856	msedge.exe
856	msedge.exe
856	msedge.exe
856	msedge.exe
856	msedge.exe
856	msedge.exe
856	msedge.exe
856	msedge.exe

Suspicious use of SendNotifyMessage 16 IoCs

pid	Process
856	msedge.exe
856	msedge.exe
856	msedge.exe
856	msedge.exe
856	msedge.exe
856	msedge.exe
856	msedge.exe
856	msedge.exe
856	msedge.exe
856	msedge.exe
856	msedge.exe
856	msedge.exe
856	msedge.exe
856	msedge.exe
856	msedge.exe
856	msedge.exe

Suspicious use of WriteProcessMemory 38 IoCs

description	pid	Process	procid_target
PID 856 wrote to memory of 4044	856	msedge.exe	79
PID 856 wrote to memory of 3832	856	msedge.exe	80
PID 856 wrote to memory of 2852	856	msedge.exe	81
PID 856 wrote to memory of 2852	856	msedge.exe	81
PID 856 wrote to memory of 2852	856	msedge.exe	81
PID 856 wrote to memory of 2384	856	msedge.exe	82
PID 856 wrote to memory of 2384	856	msedge.exe	82
PID 856 wrote to memory of 708	856	msedge.exe	85
PID 856 wrote to memory of 708	856	msedge.exe	85
PID 856 wrote to memory of 708	856	msedge.exe	85
PID 856 wrote to memory of 4032	856	msedge.exe	84
PID 856 wrote to memory of 4032	856	msedge.exe	84
PID 856 wrote to memory of 4032	856	msedge.exe	84
PID 856 wrote to memory of 2536	856	msedge.exe	86
PID 856 wrote to memory of 2336	856	msedge.exe	87
PID 856 wrote to memory of 1220	856	msedge.exe	88
PID 856 wrote to memory of 2536	856	msedge.exe	86
PID 856 wrote to memory of 2536	856	msedge.exe	86
PID 856 wrote to memory of 2336	856	msedge.exe	87
PID 856 wrote to memory of 360	856	msedge.exe	89
PID 856 wrote to memory of 2336	856	msedge.exe	87
PID 856 wrote to memory of 1220	856	msedge.exe	88
PID 856 wrote to memory of 1220	856	msedge.exe	88
PID 856 wrote to memory of 360	856	msedge.exe	89
PID 856 wrote to memory of 360	856	msedge.exe	89
PID 856 wrote to memory of 4556	856	msedge.exe	92
PID 856 wrote to memory of 4800	856	msedge.exe	93
PID 856 wrote to memory of 4556	856	msedge.exe	92
PID 856 wrote to memory of 4800	856	msedge.exe	93
PID 856 wrote to memory of 4444	856	msedge.exe	95
PID 856 wrote to memory of 4488	856	msedge.exe	96
PID 4444 wrote to memory of 2924	4444	msedge.exe	97
PID 856 wrote to memory of 2956	856	msedge.exe	98
PID 856 wrote to memory of 3500	856	msedge.exe	99
PID 856 wrote to memory of 3428	856	msedge.exe	100
PID 856 wrote to memory of 3392	856	msedge.exe	101
PID 856 wrote to memory of 3392	856	msedge.exe	101
PID 856 wrote to memory of 4500	856	msedge.exe	103

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument C:\Users\Admin\AppData\Local\Temp\resources\public\index.html
1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:856
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x23c,0x240,0x244,0x238,0x284,0x7ff8529dc188,0x7ff8529dc194,0x7ff8529dc1a0
  2⤵
  PID:4044
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1812,i,16349933313441925229,15761312956370278603,524288 --field-trial-handle=2192,i,12232022701370789854,1299024614059738362,262144 --variations-seed-version --mojo-platform-channel-handle=2220 /prefetch:11
  2⤵
  - System Time Discovery
  PID:3832
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1632,i,1308158444856214966,16048871325066464010,262144 --field-trial-handle=2192,i,12232022701370789854,1299024614059738362,262144 --variations-seed-version --mojo-platform-channel-handle=2188 /prefetch:2
  2⤵
  PID:2852
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2564,i,1408047563050710655,3460349172391932072,524288 --field-trial-handle=2192,i,12232022701370789854,1299024614059738362,262144 --variations-seed-version --mojo-platform-channel-handle=2560 /prefetch:13
  2⤵
  PID:2384
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3424,i,5900145249135355880,4847423873761317761,2097152 --field-trial-handle=2192,i,12232022701370789854,1299024614059738362,262144 --variations-seed-version --mojo-platform-channel-handle=3496 /prefetch:1
  2⤵
  PID:4032
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3428,i,1259017223805680085,1263549099716645396,2097152 --field-trial-handle=2192,i,12232022701370789854,1299024614059738362,262144 --variations-seed-version --mojo-platform-channel-handle=3500 /prefetch:1
  2⤵
  PID:708
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4164,i,15630387747674656009,4229892484304503392,2097152 --field-trial-handle=2192,i,12232022701370789854,1299024614059738362,262144 --variations-seed-version --mojo-platform-channel-handle=4252 /prefetch:1
  2⤵
  PID:2536
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4168,i,2879017631595410919,17578935351151450459,2097152 --field-trial-handle=2192,i,12232022701370789854,1299024614059738362,262144 --variations-seed-version --mojo-platform-channel-handle=4276 /prefetch:9
  2⤵
  PID:2336
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=4208,i,3623592747310976707,183677377157217559,2097152 --field-trial-handle=2192,i,12232022701370789854,1299024614059738362,262144 --variations-seed-version --mojo-platform-channel-handle=4336 /prefetch:1
  2⤵
  PID:1220
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --always-read-main-dll --metrics-shmem-handle=4220,i,15966223913755311639,10010003487363172000,2097152 --field-trial-handle=2192,i,12232022701370789854,1299024614059738362,262144 --variations-seed-version --mojo-platform-channel-handle=4364 /prefetch:9
  2⤵
  PID:360
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4504,i,5892322252477774819,2142790607130319900,524288 --field-trial-handle=2192,i,12232022701370789854,1299024614059738362,262144 --variations-seed-version --mojo-platform-channel-handle=4424 /prefetch:14
  2⤵
  PID:4556
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4500,i,12279955764397134163,11187724249346239444,524288 --field-trial-handle=2192,i,12232022701370789854,1299024614059738362,262144 --variations-seed-version --mojo-platform-channel-handle=3916 /prefetch:14
  2⤵
  PID:4800
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5828,i,9329698721299265623,12593204315133783283,524288 --field-trial-handle=2192,i,12232022701370789854,1299024614059738362,262144 --variations-seed-version --mojo-platform-channel-handle=5808 /prefetch:14
  2⤵
  PID:4328
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.ProfileImport --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6056,i,12247641940284511412,1244692682275852260,524288 --field-trial-handle=2192,i,12232022701370789854,1299024614059738362,262144 --variations-seed-version --mojo-platform-channel-handle=6052 /prefetch:14
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4444
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\cookie_exporter.exe
    cookie_exporter.exe --cookie-json=1128
    3⤵
    PID:2924
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5828,i,9329698721299265623,12593204315133783283,524288 --field-trial-handle=2192,i,12232022701370789854,1299024614059738362,262144 --variations-seed-version --mojo-platform-channel-handle=5808 /prefetch:14
  2⤵
  PID:4488
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5068,i,9729275827975881549,12924668721667030195,524288 --field-trial-handle=2192,i,12232022701370789854,1299024614059738362,262144 --variations-seed-version --mojo-platform-channel-handle=5096 /prefetch:14
  2⤵
  PID:2956
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5072,i,8907626640394167236,1163169656879596369,524288 --field-trial-handle=2192,i,12232022701370789854,1299024614059738362,262144 --variations-seed-version --mojo-platform-channel-handle=4152 /prefetch:14
  2⤵
  PID:3500
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5056,i,6691130680942639849,15747331388422692668,524288 --field-trial-handle=2192,i,12232022701370789854,1299024614059738362,262144 --variations-seed-version --mojo-platform-channel-handle=5076 /prefetch:14
  2⤵
  PID:3428
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3932,i,3819423080390922157,8616298295094929627,524288 --field-trial-handle=2192,i,12232022701370789854,1299024614059738362,262144 --variations-seed-version --mojo-platform-channel-handle=5040 /prefetch:14
  2⤵
  PID:3392
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6476,i,14483934069231832132,14429857293639769042,262144 --field-trial-handle=2192,i,12232022701370789854,1299024614059738362,262144 --variations-seed-version --mojo-platform-channel-handle=6480 /prefetch:10
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4500

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:1260

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

blocklist

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\blocklist
Size 105KB
SHA256 e0424f12e2966d4edd61d48eb03e7a78e7aa9d384165acd4a8973fc664dca54a
MD5 7acb47b9e36d0b80e2fc9707e9c8e89d
SHA1 551a4ce1b41fc63afca9012e67ab4229c732feb7
SHA512 9b137ab83de648a2382112e33229e3ec6225fb81e794374fa123d6e7e13e4de7bc9858a11d08d360a0f72c10415e71a0f49f1cffe9e27deeea1ca3cbacdcc9b3
SSDEEP 1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P7K:fwUQC5VwBIiElEd2K57P7K
TLSH
T16BB3B931457E36BF26E93EE828CF1511B84F3912664895D4ABE1FE2C4845E68633CEF4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 e8c11bffd04a845e6747271563ae4a847b510ffe734f41902fbd4b2f062eee45
MD5 9391bc4c1d157f197ee937c50a0513b1
SHA1 6876d0c906cc67e359c85730e312ab21c9022e9f
SHA512 c7624f44a5f0344859c2b10351ec030d8b7ee6532d0895f59ad3dc1f0d843ba0c30c603b9732abcbfe351222d8c06f2d73e0f439168f1a1b2222c8fd3f566136
TLSH
T10ED012663B0E7045EB1542719453C344166D606615629612B1B8955C98A55D452851C3
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 5116dd98c2b23ba5b09db7653ab553aa29b175fa64b8b9ed64ecd21beb5831c6
MD5 5ed835b9bd8886391af7b9dc575ac02b
SHA1 9a588837530f2096248ee7dee8596bb8d3c7d137
SHA512 44cb5053e3ad196ed2b5bd8cb0f51f9c889b22c1847f07a8819b2cb32d6fd93484e30687191edae9487bff46d6c4b744ba3b7a37f2b5644f920fa810083ed0e9
TLSH
T11CD012663B0E7045EB1542719453C344166D606615629713B1B8955C88A55D452851C3
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 36322ddd68f0ba12b78322fbe553c11886d9685a99c5e83f284058720c58aabc
MD5 20a068f4c73a08ae3a544712e4c9a835
SHA1 4dde3e3af4c1adfad55c1cde6acfdffa85729620
SHA512 446ab2cedff7b86e5e413aacd259ceabfa694b0fe4ea29678a541cdfe65c486896e7af7d12b5f93593e37bb45cb14ea9e66c1de4f8bd59e25fad4a13f14c75f2
TLSH
T14461701A065E0494F3193238F9D929C5783044EBC9374FBD45D09B7ED6193A1AA6353F
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 949B
SHA256 133add1181de01b594e12e99814590bc94d091e3fa9408997167af93fb1985f0
MD5 f8e89a1f003f38f7d98135a87b7a5fe3
SHA1 5da2d98c0b3e3729155d8e8ce6d88d76ade4bb4f
SHA512 1525e53ab6329482ab8727838ac96e408b793c6c5f620d200f23471d14b259e2f9f51aa6beff9610669553383c4276f2fab6e4a1ff9b6dbb1e525bc92bcd1929
TLSH
T1B11157B3C3E5856ECA0556F06A28AE2BCE2D0606421C7C1AC9D4EF2B93F3075E10259F
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 58d53fa497c0599811079d514d794584ab4150abce3b519a4d1a659b46084a08
MD5 e8d68088256857af0870ea4c9c9b7620
SHA1 bd40a4dee87dbea55d7377622d363cd11722187a
SHA512 3e59e9e301d13da51698424d89d429a905584cc569d7a7acb0ae8ac0766f515099b7b820cf80ec841ff91b51a8914df164f9d2bc88118dfb203c973c56ef45b9
SSDEEP 192:sxZsR6yM/jK1Ml8UQTFO/fdsIR6MIdpEG/W6+WNGY0s2qHXIg59J:sxZscqJO/fdsI0Vj/bG5y1
TLSH
T12F52F811AA346977CCDBE209F941BF53D6F9147391900E44AAFCDA1C01E6BED221382F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 24ccd79d6630e1349b0c0cf5a8098b4e7f09a2f8effef1445ed9ce558d32590e
MD5 36f10d17f7fe517ce3d52f21c692fbf6
SHA1 8cbddfd975d62281d676a5c25cf5e74e3d66be50
SHA512 0aabbd256f38c4c5c2c14cc5192a81814457b5e0f3f7e4ae42640a5ef56b43c1a71813c2f5a5b3bec48b0bb3ae217d429ec0c3bb6f9d307521d054b75b5bf1ae
SSDEEP 192:sxZsR6yM/jK1Ml8MFO/fds9q6MIdpyG/W6+WNGY0sh8EXIgrJ:sxZscdO/fds9ZVx/bG5a9
TLSH
T17742F7016A386977CCCBD209FA15BB53D6F9147392900E44AAFCDA1C04E6AED2217C2F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 31KB
SHA256 40ddfbe91146a12eebb7a3a5ded3e1ada948b63254836a48a96f69b4dcd8f5d4
MD5 246bafbd9069b9e34caacec890cca2a3
SHA1 805cbb13fe0aac35400009a9371633766d2c79c8
SHA512 130855cdb140e2af380f3b79fa3be0dd95a9005ced2dfb704d18921bbd26f7e6a00a6fc39587c3ac623dc7421ffdfcf934f8cc9cdb625af32daf7795fd6dcb0f
SSDEEP 768:yN/Xh8dF27kWRmwcQDw8F1+UoAYDCx9Tuqh0VfUC9xbog/OV3mjLl/k601d1roNn:yN/Xh8dF27kWRmwcQDwu1jaKmjLpkD1A
TLSH
T190E2193F280CC77E4F844E5DEC26AF966EE801CBA658495447FA894C03C77EB512A49B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 588d13771e909206528550649e41226d5e77e36c07a0ee7dcfd9cb1d1b7ad6af
MD5 cdc04f64e38ee2ac15fe44f165123836
SHA1 7d4af8e325787a75930e7a3672282038551eadc7
SHA512 36bbe0f8e5b8ecc3324c7dabec96632c7eae5925c7443edf64817706807d3f491a368c0d10b74f714e0f7074b9dcc194438288dcfc0225297e7f470a9c93f842
SSDEEP 48:K7uJuIufuzuJuvuPuxmuTuWusI5u7uxKYu4gupuxkuRuhXu+u7uPuSyWuFau4gwG:KgtaK+ACGj2KUYjwoKJ2O8
TLSH
T10B91681235F606512E7E6908C2A49B27464175A7343CE82F3FE9807A0DABE143EFD9CD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig~RFe5948b7.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig~RFe5948b7.TMP
Size 3KB
SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
MD5 904e6e94a1d46374c8630cfd86cc729f
SHA1 e1d9c3f7813878acc6510d48d95b2bf48b2e1a0d
SHA512 081e2a26252860ff8d8f7a9d0378ae56f0cc50574d13d2a121afdf74284963747ef874a4d73b1df7774cd8570972f4f513eefe0a0325fd088556d5b1ba946712
TLSH
T1DB815C4FCC0CBE77ABAB6A719A35D6B2F79131EA94518A977F8C444EE3050ED0242E50
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 11KB
SHA256 da4d63ddba38917522a6b32af06e5523950fba552c834ef2b4d912c993f23d6a
MD5 f5658e82a6bf867c324a1af5067d6950
SHA1 0209368c11eeac4be62b7c56a35a150c967fac73
SHA512 7d1e1b51f3e9236a20b10aecad2f732e7976e2ee82c9847c6f39ce3107ce61b92a61d8ca6805f8da522259b1498ef63ee12154d1fcc8559c5f3f53394294f768
SSDEEP 192:uLK8NjgQ0rlHf0el6H3ie6QmiU1fPfzB4r/rUH5m9jzorLymmX/kcmqyU8:98Njglry7Xixtzur/E5w8L2XxGU8
TLSH
T135320A3168B8AC6F4DA3A545B0473613DF75456BEBC82FA4D6ED6B1C01DE69C130AC23
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 20KB
SHA256 bb91636b6030c0e7651c9284d9159f0a3aaccea62eb425c7216171ad59175377
MD5 643bbde43da2b0106bf66d9c979cd317
SHA1 d784799fab3a5a4ca27b87ad81686df3fe8b8020
SHA512 9001872e4cade53685ade96dad1958f5d0ee938fb4e88f64d5ac0c6c154ca3f02bcc59bc16c66b35d0356fb47917bca2de027128ba725f63baada36dabb6d1e3
SSDEEP 384:cZcIw8Njllry7Xixtzur/E5w8L2XxGOOPrXLpe8C/XtK:KwLSQ/E+xGOi9PetK
TLSH
T15E928D71A8B86C6B5DB7A586F4463703DFB84527F3C82F94E6EDEB1C01CA5990306C22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 22KB
SHA256 82bd78457ee52c60ab80d182fbfb2b6889e4932130ea2028c36fa3c9254d5df0
MD5 e48e8fa59e984d8ac8d90b53703f11fd
SHA1 0c986180e34f766bd48e905ece8f186fad390009
SHA512 c27ac64b51f2680f2c5a10f884e81a4ae95b56b555b85cad4ccd4a2fe39884db176fe84c30196ad4ac3598d0f0b32b7f8f25543736bc914edbde0a54277d4820
SSDEEP 384:5iFQZcIZ8N98TUNTUlIlllry7Xixtzur/E5w8L2XwGOOPrXLpe8C/XtK:QFuZAwgoSQ/E+wGOi9PetK
TLSH
T1D1B26D7298A8996F6DB79E85F54A3203CFB44167E6C86BA4E7DDAA1C01DA1DC0306C21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 11KB
SHA256 76deb9a4f359857d6cc2f233856ef6aea23f6e6ec704f7f321958299b1ff1a93
MD5 99b449c13d2b7dec9e52aac06bbabc3d
SHA1 f0f94a5eff52b79eccc85bba472d82289d6add9d
SHA512 5d852b36ad062298628f6b97cc9e179d0a4723ea488018b17ee8ae9ecde8ac888790d0ad738976d7f221337c4b299bd704d77b43047ca37f850156e1bef9e7c7
SSDEEP 192:uLM8NjYXQ0rlHf0el6H3ie6QmiU1fPfzB4r/rUH5m9jzorLymmX/kcmqyU8:h8Njslry7Xixtzur/E5w8L2XxGU8
TLSH
T1A232093168B8AC6F4DA3A545B04B3613DF74456BEBC82FA4D6ED6B1C01DE69C130AC23
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 6ecd85e27d6460333633800f668d32da0b2c2915508dde5138c9d742cfd3c3bd
MD5 e50b1c09aa3fe6bcc8ade833df6ff13e
SHA1 8d40abed5f85f243979e3586d9054944bc2c4e3d
SHA512 ad4f12c63ced13db854218d0feabd46a8335d03c047ab5a3aa4e050e77da0368c6edbd644f62b7b6c6bc6ea2240f2f4b103ed16dda79dd363b4fdb8651ff12ea
SSDEEP 192:1GN96t6H3BQmiUyXHBHW2Qq/rUH5m9jzorLymyD9MbAyFU6:1GN96MXfAI2Qq/E5w8LFcUU6
TLSH
T10902FB3878A86CBB9EB39E46B44737139FA5116FE6951F88D9F81B1C01DB68C2345833
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 96fac52cf067ce73191d70daa1b4f0f132ba1ce36ee1b67725cf38d7908df830
MD5 75e8e55c1c959e55ebf420053e3d72f4
SHA1 0664f10b340694551d831a2e4544a4ca353faf39
SHA512 b1bc62b1e0c67de49f2aa0c5bd04ac0c4a83bd417cf31b1b0e7c0d32ad4d1ecbd7abea67474726ffe5930ec778007e3900f2b5659c7ed8d31551c1aefa00d929
SSDEEP 192:KGNe6t6H39QmiUye0W2mq/rUH5m9jzorLymmXI/9nmqyU6:KGNe6MX7P2mq/E5w8L2XIGU6
TLSH
T126121B3578A8AC6F1DA3A585B04737138E65422BEBC96FD4D5ED2B2C01DE69C1306C22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e89094e0-535a-459f-823c-8f84f30bd124.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\e89094e0-535a-459f-823c-8f84f30bd124.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download