a13e99d0f57faa842588f0c14ee7c981bf5afc59c237b6ec57c0a7b0c1a9aa8a

Analysis

max time kernel
149s
max time network
144s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260710-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260710-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
24/08/2026, 15:36

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
xwcha.html
Size 182KB
Sample260824-s14wpazfnc
SHA256 a13e99d0f57faa842588f0c14ee7c981bf5afc59c237b6ec57c0a7b0c1a9aa8a
MD5 5e6e152db7efdc761fc5afc979e51cc3
SHA1 75621e45f923501255966cb2fd7123d62f465663
SHA512 00247b0343130795eddad9bfd03d15d2cc81c0482b1b96a054c7c1ef47ac017d7d7563fd131930ad54be7e8eff5a6e836392eaf360afa08835f6324000bd6a3c
SSDEEP 3072:GE2Vtktd7+vJMgJmJ8HmHtq41RDd0njGZ11eDbJB+J5aft1BKB/NZjYXELWx8Ea5:GC1eDM5hEm
TLSH
T1DF04F9408C75CE071CD57FBC7CD77D016E8A6282A6B04A07BB195B6836F49FE31DA24A
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4232	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134320593962436368"	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2301830172-776172150-2531349243-1000\{723DAC03-8482-4AC3-A569-C9096E3B8EC1}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1600	msedge.exe
1600	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
3380	msedge.exe
3380	msedge.exe
3380	msedge.exe
3380	msedge.exe
3380	msedge.exe

Suspicious use of FindShellTrayWindow 33 IoCs

pid	Process
3380	msedge.exe
3380	msedge.exe
3380	msedge.exe
3380	msedge.exe
3380	msedge.exe
3380	msedge.exe
3380	msedge.exe
3380	msedge.exe
3380	msedge.exe
3380	msedge.exe
3380	msedge.exe
3380	msedge.exe
3380	msedge.exe
3380	msedge.exe
3380	msedge.exe
3380	msedge.exe
3380	msedge.exe
3380	msedge.exe
3380	msedge.exe
3380	msedge.exe
3380	msedge.exe
3380	msedge.exe
3380	msedge.exe
3380	msedge.exe
3380	msedge.exe
3380	msedge.exe
3380	msedge.exe
3380	msedge.exe
3380	msedge.exe
3380	msedge.exe
3380	msedge.exe
3380	msedge.exe
3380	msedge.exe

Suspicious use of SendNotifyMessage 16 IoCs

pid	Process
3380	msedge.exe
3380	msedge.exe
3380	msedge.exe
3380	msedge.exe
3380	msedge.exe
3380	msedge.exe
3380	msedge.exe
3380	msedge.exe
3380	msedge.exe
3380	msedge.exe
3380	msedge.exe
3380	msedge.exe
3380	msedge.exe
3380	msedge.exe
3380	msedge.exe
3380	msedge.exe

Suspicious use of WriteProcessMemory 30 IoCs

description	pid	Process	procid_target
PID 3380 wrote to memory of 4332	3380	msedge.exe	89
PID 3380 wrote to memory of 2968	3380	msedge.exe	90
PID 3380 wrote to memory of 4232	3380	msedge.exe	91
PID 3380 wrote to memory of 2968	3380	msedge.exe	90
PID 3380 wrote to memory of 2968	3380	msedge.exe	90
PID 3380 wrote to memory of 1640	3380	msedge.exe	92
PID 3380 wrote to memory of 1640	3380	msedge.exe	92
PID 3380 wrote to memory of 204	3380	msedge.exe	93
PID 3380 wrote to memory of 352	3380	msedge.exe	94
PID 3380 wrote to memory of 204	3380	msedge.exe	93
PID 3380 wrote to memory of 204	3380	msedge.exe	93
PID 3380 wrote to memory of 352	3380	msedge.exe	94
PID 3380 wrote to memory of 352	3380	msedge.exe	94
PID 3380 wrote to memory of 3724	3380	msedge.exe	96
PID 3380 wrote to memory of 3724	3380	msedge.exe	96
PID 3380 wrote to memory of 3724	3380	msedge.exe	96
PID 3380 wrote to memory of 3084	3380	msedge.exe	97
PID 3380 wrote to memory of 3084	3380	msedge.exe	97
PID 3380 wrote to memory of 3084	3380	msedge.exe	97
PID 3380 wrote to memory of 4160	3380	msedge.exe	99
PID 3380 wrote to memory of 5568	3380	msedge.exe	100
PID 3380 wrote to memory of 4160	3380	msedge.exe	99
PID 3380 wrote to memory of 5568	3380	msedge.exe	100
PID 3380 wrote to memory of 1880	3380	msedge.exe	102
PID 3380 wrote to memory of 5904	3380	msedge.exe	106
PID 3380 wrote to memory of 4412	3380	msedge.exe	107
PID 3380 wrote to memory of 3424	3380	msedge.exe	108
PID 3380 wrote to memory of 4288	3380	msedge.exe	109
PID 3380 wrote to memory of 4288	3380	msedge.exe	109
PID 3380 wrote to memory of 1600	3380	msedge.exe	111

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument C:\Users\Admin\AppData\Local\Temp\xwcha.html
1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3380
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x260,0x264,0x268,0x25c,0x328,0x7ffc2b16c188,0x7ffc2b16c194,0x7ffc2b16c1a0
  2⤵
  PID:4332
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1524,i,10850832380265562050,14177962020347869494,262144 --field-trial-handle=2940,i,10699155996193220400,2161355228166606864,262144 --variations-seed-version --mojo-platform-channel-handle=2236 /prefetch:2
  2⤵
  PID:2968
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1656,i,18149957601885502464,6405020808417217828,524288 --field-trial-handle=2940,i,10699155996193220400,2161355228166606864,262144 --variations-seed-version --mojo-platform-channel-handle=3100 /prefetch:11
  2⤵
  - System Time Discovery
  PID:4232
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2356,i,4802234929711805797,1487851592465465875,524288 --field-trial-handle=2940,i,10699155996193220400,2161355228166606864,262144 --variations-seed-version --mojo-platform-channel-handle=3056 /prefetch:13
  2⤵
  PID:1640
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3644,i,12590134714501045937,10674016990350044434,2097152 --field-trial-handle=2940,i,10699155996193220400,2161355228166606864,262144 --variations-seed-version --mojo-platform-channel-handle=3660 /prefetch:1
  2⤵
  PID:204
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3652,i,4058723249635437904,12874702042856212949,2097152 --field-trial-handle=2940,i,10699155996193220400,2161355228166606864,262144 --variations-seed-version --mojo-platform-channel-handle=3672 /prefetch:1
  2⤵
  PID:352
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4348,i,12881358855125376796,2516426870245874561,2097152 --field-trial-handle=2940,i,10699155996193220400,2161355228166606864,262144 --variations-seed-version --mojo-platform-channel-handle=4400 /prefetch:9
  2⤵
  PID:3724
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4344,i,14395570837781601255,13419914482269145012,2097152 --field-trial-handle=2940,i,10699155996193220400,2161355228166606864,262144 --variations-seed-version --mojo-platform-channel-handle=4396 /prefetch:1
  2⤵
  PID:3084
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3636,i,12241625850814343390,2914946462528686892,524288 --field-trial-handle=2940,i,10699155996193220400,2161355228166606864,262144 --variations-seed-version --mojo-platform-channel-handle=5428 /prefetch:14
  2⤵
  PID:4160
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5336,i,2450706162551554089,15181202532275209345,524288 --field-trial-handle=2940,i,10699155996193220400,2161355228166606864,262144 --variations-seed-version --mojo-platform-channel-handle=5464 /prefetch:14
  2⤵
  PID:5568
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6060,i,12358344603762919323,1949493792873965005,524288 --field-trial-handle=2940,i,10699155996193220400,2161355228166606864,262144 --variations-seed-version --mojo-platform-channel-handle=6076 /prefetch:14
  2⤵
  PID:3412
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6060,i,12358344603762919323,1949493792873965005,524288 --field-trial-handle=2940,i,10699155996193220400,2161355228166606864,262144 --variations-seed-version --mojo-platform-channel-handle=6076 /prefetch:14
  2⤵
  PID:1880
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5096,i,16489331186139596948,10552853996980165532,524288 --field-trial-handle=2940,i,10699155996193220400,2161355228166606864,262144 --variations-seed-version --mojo-platform-channel-handle=4348 /prefetch:14
  2⤵
  PID:5904
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4400,i,16321494535205913849,15837452152368903639,524288 --field-trial-handle=2940,i,10699155996193220400,2161355228166606864,262144 --variations-seed-version --mojo-platform-channel-handle=5016 /prefetch:14
  2⤵
  PID:4412
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4444,i,8964378333720570650,14579958261390719074,524288 --field-trial-handle=2940,i,10699155996193220400,2161355228166606864,262144 --variations-seed-version --mojo-platform-channel-handle=4956 /prefetch:14
  2⤵
  PID:3424
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5460,i,3827901365926564383,1269949673491496979,524288 --field-trial-handle=2940,i,10699155996193220400,2161355228166606864,262144 --variations-seed-version --mojo-platform-channel-handle=5480 /prefetch:14
  2⤵
  PID:4288
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=3484,i,7504589991103405769,7788877430559592514,262144 --field-trial-handle=2940,i,10699155996193220400,2161355228166606864,262144 --variations-seed-version --mojo-platform-channel-handle=5384 /prefetch:10
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1600

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:3424

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:4384

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

blocklist

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\blocklist
Size 105KB
SHA256 2bc7f3a4024d9673a2f7a098d546fe1f592a8aa0477eb259121fe80954c2f99d
MD5 403039b77d88ae3c8e79a108e60c95e6
SHA1 478b6a90cbd5967be9b36c911b5a2135e0b7199c
SHA512 fbec8c6863e6042041cea05b5efa69ca53b0340f3bee0900ef55602e442dca5b20c736b16589ad755fc44c45bb2c920ed0e29957fb7ab74fe05e101f104c82fb
SSDEEP 1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P7I:fwUQC5VwBIiElEd2K57P7I
TLSH
T1EEB3B931457E36BF26E93EE828CF1511B84F3912664895D4ABE1FE2C4845E68633CEF4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 c36ac766a384a109222b8b647d2f5c1c2e6c4672a4a2c6b8a01f6eac0a5df074
MD5 f9f896b0e6f281d55b1ca3fa3c1ccdcd
SHA1 db44df3874cd86a961c82d25f3ae2004f249b2df
SHA512 6b8c8d305c2d7e4a3b5efb6e1967d7db1b1ffdb7979edd315013037da369c923060dae4ef8a7219176aa7e0bc1fa4cb98e48470ea2f569243a95d3301f5a40bd
TLSH
T160D09BD575046A14C5A1303A21D1935392604835741945874051E55D5C5479743FB5BD
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 b53c58762bff2a5723ae446675e8f65fd50818b95383c8f3c7efef01af06e466
MD5 629a18fe1b7a241215c77a30d7d8d7ee
SHA1 5e7bd5b514f4e46a4b986c8b89d0025cf81a1f36
SHA512 04fd58619789dc107f680a57dba3aec42e4bab7c29c0defd7e1b8ca2d078ca4c91317932ff076171bae60d370b28de32c94039c6ab690d5004ddcb857977f38a
TLSH
T182D09BD575146914C5A1303E21D2935392504835601945874051E56D5C5479743FB5AD
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 449c31b4be861e217fc6e080756849c4e8aae2472a7e372635b212172d472f1d
MD5 46af078b155ad3978ce9cda125449579
SHA1 c7137c1d6d5df5567320236c4bd07fb625b0906a
SHA512 ecc186de17804f216eef0a13e72b5169260cff4451ee186a4810e3ae6a0f04b81e6ba939b12880fdd4f81df1476fb4b29d5410363f9ef1793ecfa3df03f2aad9
TLSH
T15F61D65FC32EA8E2C72490B315E208C9367484E1E6CF2E9B82B6F57C940E795B61433D
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe599a62.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe599a62.TMP
Size 3KB
SHA256 4d548fb45546307d7e2ee278fff7266bff2a1f6f8805d221f79be63bb19cbd12
MD5 8c635520f053cd6580ff1edc7164ca59
SHA1 9f33d9cdc19ebc44cbce358db98cdeee74e026b6
SHA512 21b63afcdaeec3f0e7a0a5d9f5bf78bc2ac58867112c00c7a23d2a3ab0b4ab57981177f05cf642c9c85c05798f52f320f6ed33da589cdf90b64220f53e8d6d62
TLSH
T14761D65FC32EA8E2C72490B315E208C9367484E1E6CF2E9B82B6F57C940E795761433D
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 1KB
SHA256 e6e06f9abf428d57a9d40d9a6df3b7d77754fd5bfac693ed2a16a91fcec4972a
MD5 e055beebf71f96b638e02b38068d6b54
SHA1 ee7135d12359455d20c208bedb466ae4176d74bb
SHA512 be920521e6ea212016032a0af7976c471cc79155de92e88729f61b70b8cf6c800d81208f623a3a832433266cec9ce37e5404efa9f1005d015eea035f36e35274
TLSH
T1B2218BF2C2D4877E9D0112F09B29AE27CE5D0956422C3C56C9E8AF1F63E2474D2016AF
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 79085582fdb90dffecba6138e38bb7154d731f2137b339884f96cb52cfebb908
MD5 eef91a3edd22488fd3532dd5c6a8f2f8
SHA1 bc5fd95431d39a0102491ed79f73501c83664ea2
SHA512 2aecd4f503a2e4a91fed0ea5f58098fbf365a93fbd8c979846184e9317382f4d977c5a37485a94cd27437915b7f0fb3a0a0137c99699b91d9dd47d34a0862d1c
SSDEEP 192:sxRF/yM/jK1Ml8wbj/fssUJsmZOzoA8p4i/g6+WNIYx/ltJiGRRIgIJ:sxRF7lj/fssUJl//5IiLds
TLSH
T19852D8059A389977CCDBD21DFA917F53D6F81533A1901E44AAFC8A1C00E6AED2217C2F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 f62c0778823850a72403d32746cf6e6b53bc3d1ec7aed282d2e002913a201672
MD5 6dfd364c2a720c3299339ac092653c46
SHA1 66d39f180f38b80790e94184899a0fd34326aab5
SHA512 68d94e0781dde68e6b4ff359ef62413a664dc1d1ea2608f716c2d5c6b3c5135973c10e8c86da0c7ce568bfd93cd33769b06afc2f21f9fab87fe6fd696b57e7b9
SSDEEP 192:sxRq/yM/jK1Ml8UQibj/fsssDsmZOzoA8pei/g6+WNIYxHlzJiGRRIgDaJ:sxRq7qkj/fsssDlp/5IWLdC
TLSH
T1A262D71599389A77CCDBD21DFA917F53D6F81533A1940E44AAFC8A1C00E7AED2217C2B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 8025ba949365de0ef71088ddb6e5e2a5035f2db4e704cacbe16aab02275de12c
MD5 bf8d01a69d1d1fd6682127c52e250a62
SHA1 b5aa6689779c3d241e8089f9b8e55dd75db91abf
SHA512 46c6b64097efca6ef9c6ff6475e13a590b721b7b38b6f1423b1e7997690c9b85ee636b7572768db6dca173435d26792e7798a319d03be6259e94f617a6520559
SSDEEP 192:sxRq/yM/jK1Ml8wbj/fsssJsmZOzoA8p4i/g6+WNIYx/ltJiGRRIgDIJ:sxRq7lj/fsssJl//5IiLdI
TLSH
T15552D90596385A77CCDBD21DFA917F53D6F81533A1901E44AAFC8A1C00E6AED2217C2F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 27KB
SHA256 e3f20051ceb002f067c3711c3acdd99e24e78ed1e458839a3964f7f04de32c2d
MD5 b769ad81b8378966b965f16685c03e6a
SHA1 3591882407d3b1a73c2e3edc6415cc254d14583d
SHA512 32f09374d7992857fb0e6cf42f4f68740c950a5fb2d491635fc0ba3f125a2b71a79bf7b82621144b73247df9fd2208e434ce05b396e3e3dc57895cfb1ced7fd6
SSDEEP 768:0xCyAjWgbrfM18F1+UoAYDCx9Tuqh0VfUC9xbog/OV9rVASroJPe+Z:0xCyAjWgbrfM1u1jacpAJJPPZ
TLSH
T145C2EC3B640CC77E4F844AADEC25AED77DD802CB97984D544BEA880C03C67EB521A5DA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 17cf5ed519c9d3db45f3e04887223c5391ae5e3e870ead619459d9d68b0d122f
MD5 34f5b4061473133ec26939d2c7084709
SHA1 9e86f28669e03faa2360552447468af2bd059180
SHA512 ae88c85710ec98d0050770f67ab6a864d3153f46f15f17ef94b01fe9ca369a4a3eb616f536bdec9b3c598a68e1cccc5626814daab9061e270fe703be7ab6969b
SSDEEP 48:KyOXQse8IXVhIpKKcM7ypGIPK/aUj+IfK7S4zyD:KAVhWKKca6GYK/as+UK7Smg
TLSH
T1D1918651717A12123ABE78089191C66AC6C2B1B33054E42F3BE8447A4FB7F514DFD9DD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

OperationConfig

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig~RFe5a3588.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig~RFe5a3588.TMP
Size 3KB
SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
MD5 904e6e94a1d46374c8630cfd86cc729f
SHA1 e1d9c3f7813878acc6510d48d95b2bf48b2e1a0d
SHA512 081e2a26252860ff8d8f7a9d0378ae56f0cc50574d13d2a121afdf74284963747ef874a4d73b1df7774cd8570972f4f513eefe0a0325fd088556d5b1ba946712
TLSH
T1DB815C4FCC0CBE77ABAB6A719A35D6B2F79131EA94518A977F8C444EE3050ED0242E50
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 f50f291bc6bb01d72d9b5c8d5fa523d813d4c9d68b97df7488c5bd7918196902
MD5 8de9919d37f5449e9c739dca79e42e0a
SHA1 be564622bb9f1f63ed893ea93de3e54ff3392db7
SHA512 c86a4219535276a1eafa70f3569a191c9cb2e3db1f8c1c45203bf92ff084b9084eabc389efa881a992b06ac8c3f187f2452ae16c638cd9afabdf7b906d36c7a9
SSDEEP 768:xrv+4UNbdH3FcBkKL2cjF669yrqUjWiIwwxMtVESm:xbsbl3/kjF66INWZTMHi
TLSH
T1AF03BE30B8A86BB3CDF6D681B1437683BF745093D6C50F98D6DCA70D065B8D9234B926
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 36KB
SHA256 ee9a661b59441264bda9bcd48ee699c2b69bd36bcc6d26a0f94374b6779f1e8a
MD5 12fce228a8f322599f666accce330d6f
SHA1 784676ab7a6546866c0b9bb51f9d930c95ce1f15
SHA512 16cb48258efc5c5ece6eb4a6a60c4e444af69d54d6f9613b94f38ceb5a98a9f60233c0b2919c45fc4096745d1c01c4897131027cc59697de7aa30afefa269b75
SSDEEP 768:lFQ532wgEcBkKL23nF669yrqUjWiIwwxMtVfCwz:E53hfnF66INWZTMHfCwz
TLSH
T192F2AE71ACD48AB7CDFADB81F2127683EFB040A3C6C99E9496CCAA1D015B5DD1347C26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 39KB
SHA256 34959e5b1332c651ca7c58cd97de1f06ed19c1588e3a7b4824f9a2dd1ba631ab
MD5 99950dba2c56a562a97a22e6311fc14f
SHA1 f645beb9ad45dea61d2c703b10cc075a97c1d071
SHA512 d41ce0830f10aff8395d2ac71f3b61fe1a8be2d71f6eef5f80b4abe8bf43d231f98f2ddc5b73aa7ad467388a4a75fc77bdc51320df8826ed8717ac4cd88b38e6
SSDEEP 768:xrv+4UNbdl3wcfkKL2QjF669yrqUjWiIwwxMAVUiler:xbsbX3Q4jF66INWZTMYUsQ
TLSH
T18703CF30AC989AB3CDF6D682B1437683BF745043D6C50F98C9DD670D469B4C92347A27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 1b56cb8df7967fdd23b074b0ab69276ca3a1d5ffdb652892786a9ce87df847a2
MD5 27560c8d05a65206c82ad62793088f4e
SHA1 493cc044f5d96a6c08d881141786abcb6015eed4
SHA512 b613701031e1849a65ee9b177dbf27a36318c56cf34a46c01ff9b58401ead2a01f32861234e0290ba66d9940c7be39b7367263f86ffe3e788000a8a7e9d4e255
SSDEEP 768:Vrv+4UNbdH3RcBkKL24GjF669yrqUjWiIwwxMtVESm:Vbsbl3zAGjF66INWZTMHi
TLSH
T19503BE30B8986BB3CDF6D681B1437683BF745053D6C50F98DADCAB0D065B8D9234B926
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 34KB
SHA256 0304ca451ac7e0a576712eeb068dee46b9f92dc8ae3ee9cde12a42e77999b7eb
MD5 abcea7c429346df2c754c7580c100c8c
SHA1 c227323fc0529ec4c7297b2fd2cbcb8eb63583b6
SHA512 b8e5a42a94846f31eba52902a2136cdf2bfa90b6950593cd68bd040196f2f61c1ccd17fcc127718507eefd6f159ec297edf77f1243cd39ebb055827b4adcd837
SSDEEP 768:HY3dcBkKL2cjF669yrqUjWiIwwxMtVfCwz:HY3HkjF66INWZTMHfCwz
TLSH
T117F2BE70ACA49EB38DFAD782B2027783FFB44053D6C94E9885DCA71D055B9DA1347C2A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 34KB
SHA256 9ed48635abadcc1861ceb0f4ac09389bc528d0e98bdd8fae5b99dc6de6741d1c
MD5 e1f397e0216377c53a2380891b4121de
SHA1 2c00c4a33200032ff9e7b48cf676d3c4094eb5b5
SHA512 276ee05c76f8e3400a7a2329c5527bb8d324dfba90a6c618be506657e420b1fdd6f877802e12141add64c8b6f2a1406f88cb465d2eec6c7dc8e20e2f494846ae
SSDEEP 768:nY3ocBkKL2cjF669yrqUjWiIwwxMtVfCwz:nY36kjF66INWZTMHfCwz
TLSH
T1D0F2BE70ACA49EB38DFAD782B2027783FFB44053D6C94E9885DCA71D055B9DA1347C2A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 3622f1e0d9e53ef0c67789cf9182ba25fdc480ed7d9a64eef0acef13719714d8
MD5 99c3bf1f5177e2dba3a0bea788d849f4
SHA1 a7c05181c94a29883c956a1a03522eab083a2d8b
SHA512 bea06e1d47ec5b34e4f6df69e357fffd6bdeb1bdba23fa9216fd202682b1df3433816a162147fc4ed2138c9b8413ffc47e9b047f0cb3265f7e8ed30dd9ef741f
SSDEEP 768:arv+4UNbdl3MPkKL2+jF669yrqUjWiIwwxMR9Uiler:absbX3z2jF66INWZTMjUsQ
TLSH
T16403CE34AC589AB3CDF2D686B2437783BFB4109396C40B98C6DD670D469B4DD2347A27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

05d8e6b8-293b-41d5-b8ca-9696875768d2.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\05d8e6b8-293b-41d5-b8ca-9696875768d2.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download