3eb8eec89012cde36c3ebc60366c925e0b36c490016cd8b3ab0d00f1a2468d82

Analysis

max time kernel
148s
max time network
150s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
15/08/2026, 06:00

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
3eb8eec89012cde36c3ebc60366c925e0b36c490016cd8b3ab0d00f1a2468d82.html
Size 81KB
Sample260815-gqlftazfpb
SHA256 3eb8eec89012cde36c3ebc60366c925e0b36c490016cd8b3ab0d00f1a2468d82
MD5 aa2b38b7cb2e81e2a24febc79e2df140
SHA1 11b4837a81fbf8ef547229396770552fbcdf9ba5
SHA512 63096bbc39d533f111c17f778143b8b65acd256c363d3d498a80d04726f62d216e292be6d4335804e28f2e184848c01d178459ee70517409bf059d87aabbc77e
SSDEEP 1536:sWowGUZvRsOktRQ685w9sEpHXZ/MlyAamRBQOE2Z/U:YU77n5ksEwam4
TLSH
T1BD83F9B9F5A170725E13F970402F910FB93B646BE40C0AACF154DCE0AEF658A8566F2D
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
892	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134312472442372280"	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-3986082593-3624157295-3514260330-1000\{9DF63660-7DA1-4F9F-9929-4FF342503615}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3168	msedge.exe
3168	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
5232	msedge.exe
5232	msedge.exe
5232	msedge.exe
5232	msedge.exe
5232	msedge.exe

Suspicious use of FindShellTrayWindow 33 IoCs

pid	Process
5232	msedge.exe
5232	msedge.exe
5232	msedge.exe
5232	msedge.exe
5232	msedge.exe
5232	msedge.exe
5232	msedge.exe
5232	msedge.exe
5232	msedge.exe
5232	msedge.exe
5232	msedge.exe
5232	msedge.exe
5232	msedge.exe
5232	msedge.exe
5232	msedge.exe
5232	msedge.exe
5232	msedge.exe
5232	msedge.exe
5232	msedge.exe
5232	msedge.exe
5232	msedge.exe
5232	msedge.exe
5232	msedge.exe
5232	msedge.exe
5232	msedge.exe
5232	msedge.exe
5232	msedge.exe
5232	msedge.exe
5232	msedge.exe
5232	msedge.exe
5232	msedge.exe
5232	msedge.exe
5232	msedge.exe

Suspicious use of SendNotifyMessage 16 IoCs

pid	Process
5232	msedge.exe
5232	msedge.exe
5232	msedge.exe
5232	msedge.exe
5232	msedge.exe
5232	msedge.exe
5232	msedge.exe
5232	msedge.exe
5232	msedge.exe
5232	msedge.exe
5232	msedge.exe
5232	msedge.exe
5232	msedge.exe
5232	msedge.exe
5232	msedge.exe
5232	msedge.exe

Suspicious use of WriteProcessMemory 30 IoCs

description	pid	Process	procid_target
PID 5232 wrote to memory of 4680	5232	msedge.exe	89
PID 5232 wrote to memory of 1472	5232	msedge.exe	90
PID 5232 wrote to memory of 892	5232	msedge.exe	91
PID 5232 wrote to memory of 1472	5232	msedge.exe	90
PID 5232 wrote to memory of 1472	5232	msedge.exe	90
PID 5232 wrote to memory of 3628	5232	msedge.exe	92
PID 5232 wrote to memory of 3628	5232	msedge.exe	92
PID 5232 wrote to memory of 2800	5232	msedge.exe	94
PID 5232 wrote to memory of 5752	5232	msedge.exe	95
PID 5232 wrote to memory of 2800	5232	msedge.exe	94
PID 5232 wrote to memory of 2800	5232	msedge.exe	94
PID 5232 wrote to memory of 5752	5232	msedge.exe	95
PID 5232 wrote to memory of 5752	5232	msedge.exe	95
PID 5232 wrote to memory of 5348	5232	msedge.exe	96
PID 5232 wrote to memory of 1772	5232	msedge.exe	97
PID 5232 wrote to memory of 5348	5232	msedge.exe	96
PID 5232 wrote to memory of 5348	5232	msedge.exe	96
PID 5232 wrote to memory of 1772	5232	msedge.exe	97
PID 5232 wrote to memory of 1772	5232	msedge.exe	97
PID 5232 wrote to memory of 4548	5232	msedge.exe	99
PID 5232 wrote to memory of 700	5232	msedge.exe	100
PID 5232 wrote to memory of 4548	5232	msedge.exe	99
PID 5232 wrote to memory of 700	5232	msedge.exe	100
PID 5232 wrote to memory of 2276	5232	msedge.exe	102
PID 5232 wrote to memory of 5536	5232	msedge.exe	106
PID 5232 wrote to memory of 3160	5232	msedge.exe	107
PID 5232 wrote to memory of 1676	5232	msedge.exe	108
PID 5232 wrote to memory of 1284	5232	msedge.exe	109
PID 5232 wrote to memory of 1284	5232	msedge.exe	109
PID 5232 wrote to memory of 3168	5232	msedge.exe	111

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument C:\Users\Admin\AppData\Local\Temp\3eb8eec89012cde36c3ebc60366c925e0b36c490016cd8b3ab0d00f1a2468d82.html
1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:5232
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x260,0x264,0x268,0x25c,0x2c8,0x7ffa1a87c188,0x7ffa1a87c194,0x7ffa1a87c1a0
  2⤵
  PID:4680
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1596,i,11942399267750854504,336728002493201033,262144 --field-trial-handle=2248,i,11173045642109690198,15086995431315116947,262144 --variations-seed-version --mojo-platform-channel-handle=2244 /prefetch:2
  2⤵
  PID:1472
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1852,i,12945945408341352846,893203687594743572,524288 --field-trial-handle=2248,i,11173045642109690198,15086995431315116947,262144 --variations-seed-version --mojo-platform-channel-handle=2708 /prefetch:11
  2⤵
  - System Time Discovery
  PID:892
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2380,i,5701506821819042060,10513084732125955678,524288 --field-trial-handle=2248,i,11173045642109690198,15086995431315116947,262144 --variations-seed-version --mojo-platform-channel-handle=3228 /prefetch:13
  2⤵
  PID:3628
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3552,i,18323461397161537552,12425559116242139648,2097152 --field-trial-handle=2248,i,11173045642109690198,15086995431315116947,262144 --variations-seed-version --mojo-platform-channel-handle=3624 /prefetch:1
  2⤵
  PID:2800
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3556,i,9476376051860978195,15390059894259158873,2097152 --field-trial-handle=2248,i,11173045642109690198,15086995431315116947,262144 --variations-seed-version --mojo-platform-channel-handle=3628 /prefetch:1
  2⤵
  PID:5752
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4236,i,7801677557693727900,12837784462594790446,2097152 --field-trial-handle=2248,i,11173045642109690198,15086995431315116947,262144 --variations-seed-version --mojo-platform-channel-handle=4876 /prefetch:1
  2⤵
  PID:5348
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4248,i,2481443469029203268,8796761742829438173,2097152 --field-trial-handle=2248,i,11173045642109690198,15086995431315116947,262144 --variations-seed-version --mojo-platform-channel-handle=4728 /prefetch:9
  2⤵
  PID:1772
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5256,i,9026681547883656026,6423242847408113757,524288 --field-trial-handle=2248,i,11173045642109690198,15086995431315116947,262144 --variations-seed-version --mojo-platform-channel-handle=5360 /prefetch:14
  2⤵
  PID:4548
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4240,i,9321864303716432209,17685116576088633769,524288 --field-trial-handle=2248,i,11173045642109690198,15086995431315116947,262144 --variations-seed-version --mojo-platform-channel-handle=5408 /prefetch:14
  2⤵
  PID:700
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5924,i,12257952496074172465,2134374587432341443,524288 --field-trial-handle=2248,i,11173045642109690198,15086995431315116947,262144 --variations-seed-version --mojo-platform-channel-handle=5944 /prefetch:14
  2⤵
  PID:5852
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5924,i,12257952496074172465,2134374587432341443,524288 --field-trial-handle=2248,i,11173045642109690198,15086995431315116947,262144 --variations-seed-version --mojo-platform-channel-handle=5944 /prefetch:14
  2⤵
  PID:2276
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4960,i,4791049081416663467,14090934732132191840,524288 --field-trial-handle=2248,i,11173045642109690198,15086995431315116947,262144 --variations-seed-version --mojo-platform-channel-handle=4972 /prefetch:14
  2⤵
  PID:5536
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=600,i,12864862858796614863,16109569088344956161,524288 --field-trial-handle=2248,i,11173045642109690198,15086995431315116947,262144 --variations-seed-version --mojo-platform-channel-handle=4964 /prefetch:14
  2⤵
  PID:3160
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4976,i,5939623184350788886,5107473928120372749,524288 --field-trial-handle=2248,i,11173045642109690198,15086995431315116947,262144 --variations-seed-version --mojo-platform-channel-handle=5100 /prefetch:14
  2⤵
  PID:1676
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6216,i,7572519467549145907,11383868735707798894,524288 --field-trial-handle=2248,i,11173045642109690198,15086995431315116947,262144 --variations-seed-version --mojo-platform-channel-handle=600 /prefetch:14
  2⤵
  PID:1284
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=2668,i,5334792734167712060,3406656154305597879,262144 --field-trial-handle=2248,i,11173045642109690198,15086995431315116947,262144 --variations-seed-version --mojo-platform-channel-handle=6508 /prefetch:10
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3168

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:3120

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:4812

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 da739d58d61b2ac7b5d9bb7ad60982cb15b364d9c7c9297fd0c9719c271cd985
MD5 2d2e0ac0da9a175b4b6a8be7c9d51cce
SHA1 ff15c8a5ff11faefae3f7491c7968a2163702b81
SHA512 0ae78f15909f04e1a81109917b8eeb5b8062a49558d8a40f15c02076b087f36e82b88b329e9d984fc68c62cb15408123b9db7f705f2745bfefc30b5aa2e164e6
TLSH
T1EAD09B5A72455D4CD641343224E55217E3108821754546194253F0768DD668717ABD9E
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 18a644ba613d5b4137dabc346f57eca622b6888922eaec751025ab3c0a002fd5
MD5 5eddc74c05def624cfd47ea0a7e304a5
SHA1 b5f795fcc3846bb781e66e0373fce119975b2659
SHA512 1c777d774c154e89b80817ce7344495d83eecf133c36e0ad7c60dd14d76e628697535cc3fc379ca4eeb776f3bea5096f94d0fd76a2394ecd2e52f5ca8dc0053f
TLSH
T133D09B5672455C4CD641343224E55217E3008821654546194353F0768DD668717ABD9A
MD5 SHA1 SHA512 TLSH

Submit Download

2e39a964-95cf-4ba4-a576-25d3c41017fa.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\2e39a964-95cf-4ba4-a576-25d3c41017fa.tmp
Size 11KB
SHA256 67212b466f55ae6862d03aaa0fd2393d5fc9ba661a4a7cee0bce25e4e888e527
MD5 2a00f0c659216f9eda559f46fbc4aa33
SHA1 e4b2c3ee78a2632dc3b01b4be5f31430bd2db695
SHA512 f50ace24cb4999e19163c0f596395a9a95c79e1e3b829c002edfad23bcf4a4595cb3586ed6081913884a00d9f2c9e731e0f1d3b058d454a95f1e701c267af94e
SSDEEP 192:sxReRibLS/fjrsHSKZYCbW0zoA8p4a/g6+WNIYEgf32+G2jdIgDTJ:sxReOLS/fPsyKZPGf/5IK26BR
TLSH
T10532C7166A68A93B4CC7E21DBB55BF53D7F95032A0912E48BAFC871C05EB6DD220740B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 2KB
SHA256 70d3c6c1db5ce8bbbf8f7d4737a72dfaba238b3e2b0fa25f5b122f73170e0be6
MD5 af80b9181d4d2cc260b66a0dc385420a
SHA1 d89a9328e14b066f317d2cf4ec17d0510cc31278
SHA512 3ddc04848b583e19bb76bd66265f6c476cca3265208a3c8db6b750c6e0d6930965f3808c6d82e4e73af3995e0eaa5f7ee70142fdc95fcda45635bcd3813b280b
TLSH
T19051958B1FA309FBE761E7BE7EE1A4E9767086B945171E085DCC21F8F405B865010338
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe597a37.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe597a37.TMP
Size 2KB
SHA256 d9a360c373575f9dfc4292f9bdbe30db7c3211f2dc183ede8dafcaf60b23abd0
MD5 135b5a0b311c97ec9e7cf64d45d94b4b
SHA1 3090d5c2b6146c3318f016523bd305a0b74625aa
SHA512 748d5c0dd5ebaef0f1364a7e4f2fb64d4c32f68c2e6c686f0e95dac1d1245f29f41ffeb13d0b8725f0915e673677dd4e565a9e785fd643bc8bb04189060fd72a
TLSH
T1DA51958B1FA309FBE761E7BE7EE1A4E9727086B944171E085DCC21B8F805F861010338
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 45c1de6096676844949460133a0678361e06cd23b22aebdd1f0e98e66511221f
MD5 43b763ea567f987ba5b5281f05ff9c8e
SHA1 b38a3c752a2e4fe453a28a56d209380170c64800
SHA512 351a5339b8f39c715efdad986a949965824e5427de5cd68a61f619e28694c3709619308c2456d0fc9d7c49ceb1e17fb7f253df3a3735c55b9b12c986bc21183d
TLSH
T1CA419CF783E4867E990156F0AB18AE2FCE2D0515432C3D56C9E4AE2B93F3471E10269F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 5debe6770e380265ec86e7b83af8a7d7bc9da57cbc7281f32baeb56505d34a7a
MD5 7e3b4829465d52481cc6c47923e3f13a
SHA1 cd2e8f703ecd85561a71e978fc5d08a0164cbed1
SHA512 b28ad130a5814d99b6feea83bb0e40fe40030532875db3868f55e14577829f49d50f7ef2f23a975709fdc9d237402408313ff5e02ecb1d78a4396cedb17c0a57
SSDEEP 192:sxReRibLS/fjrsHSYZYCbW0zoA8p4a/g6+WNIYEQn32+G2jdIgDVJ:sxReOLS/fPsyYZPGf/5I426B7
TLSH
T1B542C7166928A93B9CC7E21DBB55BF53D7F9503260912E48AAFC871C05EB6CD220740B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 350b9c51607873ab1031c32610b9ef7abfd09d271cd2adb32395c764b1378c64
MD5 5332bccbc4a7601ff50a99ce6c9ade64
SHA1 6544301c331a0d211bf41305a6a2872832af02dc
SHA512 bbb95249c1b4ae568cad841466041c86b9c3afae5699b5f1bf75255cecc4c555265f69323999ce1dc1096a9b03e8bd2d8f503568da2fe540d5708837d52ea910
SSDEEP 192:sxRVRibLS/fjrsxSKZYCbW0zoA8p4a/g6+WNIYEgf32+G2jdIgIJ:sxRVOLS/fPsAKZPGf/5IK26Bs
TLSH
T18732B8166A28A93B4CC7E21DBA55BF53D7F95033A0952E48FAFC871C05EB6DD220740B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 23KB
SHA256 59c3a87e87472d157e1431e9699ef514ba08f9afbce3a8c6cda1fd188fb3db44
MD5 3474f5d5b9371836189e0f0395590d0e
SHA1 93aa4b968c08d891f54d14945b31fa46c9e548a2
SHA512 5091449e3b4eb757fd2f9bfd17d16036eb460a2539a51b6b22309d8adce6ff57ae366b6eb7b6f5a9c4c6554bcfa1fb23183d0edd4b078da3636dca8f6489e6eb
SSDEEP 384:40DxK6DJQD810DrfCtgQ6DRFfIQDFKhOObJ+UoAYDCx9TuqZz0VfUCh7xbog/OVS:40Dk6DJQD810DbWgQ6DjfIQDF8F1+Uoz
TLSH
T1C5B2EB2F640DCB7F5F804A9DAC196FD76D9802C796988D8047FE990C02C77EE92194DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 c9afee7ec4c8bbd0463d801274c59de8d80cfb58ca9c8c3bef6e1a9979908984
MD5 54bb434aca9c954177faf2eb3b280656
SHA1 eab35fcc9fc259d1ad50e3546d462f8d3ee5d1de
SHA512 84dfb150fc5feb8d7fb90e6958d8c1406e3d6de1a6bf5164cd95e3ea32b2a1fb092c8a5814c891139b0d195fb733fcc8425c18bdc733d1533a3aeddae2ac7639
SSDEEP 96:KRl9lKlDl3ltlHlblPWlDlYlGgl/lPK4leglhlPclFl9lwlToZs4q26gWeDzggge:Cl9lKlDl3ltlHlblulDlYl3l/l1legle
TLSH
T1F9915341377B42403CBF754C85B89A5B9292B4633015AC2F7FE801A5DFAAE114DFE8C9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

d6e8c0b5-339e-49d0-9cf7-9c7811a9cd71.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\d6e8c0b5-339e-49d0-9cf7-9c7811a9cd71.tmp
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 36KB
SHA256 c879836950936c80b447f861a4e995d75b0fe6343498692f092bfb179063c75d
MD5 e67d1b55db5d1b031e11f40bcf9674f5
SHA1 ce9566ab891438b17c2dd9ac221f543be6c734bd
SHA512 dd8d66a0b798dd799e7df302ebdc244dbc194cc3d5ba1a81706f444bb0dec7747b1da219643a19881e589ca9b97a692c218885eefae84c30a9e3eabdb673f8fa
SSDEEP 768:M43VKq+5cDTd+ZUtpbeX6+qTko0u229a4vsTlPi9PZ:M43V2+KvVTVKa4cPW
TLSH
T190F2C071F8A45C674CF6EBC4721736476EB51263D7C8164499EDEB0C058B62C270BC2B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 42KB
SHA256 97e3692e7e1bacd93c4100f6ec36467bd7fcf9d1f4e5ae37b35f48347f5b3216
MD5 f6289c27c131da9936750343c741e536
SHA1 9d3720afc7a986ddf2542e0c5959b009d4b43bf6
SHA512 9bec15afadc9bcd7a289701fe827d8aad7bf7b88a470e010a727f5c6bf56d1b6b66fa82f29f69b7d6cb13eb0729a025497cc596062ef8b139cd8fed577d1fbbd
SSDEEP 768:srv+4UNbdf3iKq+QcDTd+ZUtp1eX6+qTko0u229a4vsTlPi9Pv:sbsbR3id+UvVTVKa4cP0
TLSH
T17713BF32F8689D778DF6DAC4B11B36477EB81263D6C8168499DDAB0C068F56C230BD27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 35KB
SHA256 c1fdffcfcde84b2cac195d723876a647cafe187dc72c798f541b88f1b469d31b
MD5 7e30f8f50c73b2e80ff48e920ca6c62b
SHA1 c7fabaa72648a8afe4da7bccd4e6830e93e10642
SHA512 ac0993ed3a13cfc6eb0aa111193747c3132fd6879790a26d06d2510a4d66985dc96b2e7e29218629f0c1e451dceca6ce89f6d0fb529629f7cd0f26deee3dc98a
SSDEEP 768:I43iKq+5cDTd+ZUtpbeX6+qTko0u229a4vsTlPi9PZ:I43i2+KvVTVKa4cPW
TLSH
T1B2F2BF71F8A45C674CF6DBC4721736476EB51263D7C82A8499EDEB0C068B66C270BC2B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 66fc459aeed48df0b341b92db17a85ca8e6552b6eeecc6b9142df99bbb33b7e6
MD5 27ce753af5a8e345e39fb01e7b9efbb5
SHA1 acc6394f9034977d968394befcecb4b4aa2cf4b3
SHA512 7440662307d35db4f107c1a6b8e0f6d4797b8bd1d5013fe7e52794ba1b624718704b9b399c5c6421e91c0ee7673ff38c73bcc7b7ed581bbcbfca228e4f930f84
SSDEEP 768:wFQp3FwgvKq+5cDTd+ZUtpveX6+qTko0u229a4vsTlPi9PZ:jp3D2+uvVTVKa4cPW
TLSH
T13303B072EC9499779DFADFC4B61B36079EF50273D6C46684AADDDA0C018B16C230BC26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 39KB
SHA256 863038386fbb3cb1bb401b3ef93e25173ac35ec5b49213d6753e2d637dd8eb38
MD5 02c35fbd1b85ba7749c26464e1b293e8
SHA1 cf1c6a192cf6e585bf179451bf7b0c25af0fb8a8
SHA512 8ea874815202ad03860e96ce65d56b89d9854ac8e4d56c2afab8c8bf6895a803d19f679d804f321407f470977a621b702632c948d4700696cdd8786271dac3d6
SSDEEP 768:prv+4UNbdG30rpDTd+ZUtAeX6+qTko0u229a4vsDneVH1SdW:pbsbU3f8vVTVKa4WEH1h
TLSH
T14803BF32E8648A778DE6D784714B75473FB95163C7C80B80D8ED6B0D069B5AC230BE2B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 40KB
SHA256 7d534967bd26613d001ef6f44ce28816e31b29045ecfc25104772cc54856f157
MD5 8a1e6c7b2e8bfab8869c16a6787d87a0
SHA1 6ff67906307bf9cdefa691a6e96b2b23912b84af
SHA512 ce8d534178fa6cb7e481f37de01dc3be21e84f09ec56a352807ab065ae488541fd577e981f0d6f587cacade59220beb5eeb531ec8d2cb9002e3cffa1933341c4
SSDEEP 768:lrv+4UNbdG3fuCDTd+ZUtpBeX6+qTko0u229a4vsSleVH1SdW:lbsbU3I+QvVTVKa4DEH1h
TLSH
T12003BF32E86899774DE2D684714B350B2FB95263C7C80B84D9DE6B4C069F5AC230FD2B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

232ad632-143b-4f28-b293-f06d6124978b.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\232ad632-143b-4f28-b293-f06d6124978b.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

memory/2276-170-0x0000027458970000-0x0000027458D2B000-memory.dmp

Download

memory/2276-169-0x0000027458970000-0x0000027458D2B000-memory.dmp

Download