8fc6e65677615a66d485ef1e3963d64f3c61824b7a610a1b564eb3fa951ce018

Analysis

user interaction
yes
max time kernel
148s
max time network
132s
platform
windows11-21h2_x64
resource
win11-20260513-en
resource tags

arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
25/08/2026, 19:07

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
1541886677692190840.html
Size 62KB
Sample260825-xs2htadp21
SHA256 8fc6e65677615a66d485ef1e3963d64f3c61824b7a610a1b564eb3fa951ce018
MD5 33431317e06f4806b95f99082c4fda6c
SHA1 021b39d0b39319fd890a7973e5a345be13adf205
SHA512 a97127558ddc5e69ae772a56f2dfa89753198a4a58ba5891aa71b224344e599f28e137dc0ad5c028d433a7b975fc096c6b27bb4b8a7359537ed1ebac3a020cf2
SSDEEP 768:69H8YIRx8OcwBUs+eVEvS5wtpNp4itbFRURx/0:A5O9UUEFHNicFRYx/0
TLSH
T141534D599C09C6E870313E87F575F1EEC589720ECC75EA3894FA922D6235FC849A6C32
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
2844	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134321584793926307"	msedge.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2409539145-3342400454-2096821238-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2409539145-3342400454-2096821238-1000\{1338D70F-EF88-413C-A4F7-61A87076DA21}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
5944	msedge.exe
5944	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
3452	msedge.exe
3452	msedge.exe
3452	msedge.exe
3452	msedge.exe
3452	msedge.exe
3452	msedge.exe
3452	msedge.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
3452	msedge.exe
3452	msedge.exe
3452	msedge.exe
3452	msedge.exe
3452	msedge.exe
3452	msedge.exe
3452	msedge.exe
3452	msedge.exe
3452	msedge.exe
3452	msedge.exe
3452	msedge.exe
3452	msedge.exe
3452	msedge.exe
3452	msedge.exe
3452	msedge.exe
3452	msedge.exe
3452	msedge.exe
3452	msedge.exe
3452	msedge.exe
3452	msedge.exe
3452	msedge.exe
3452	msedge.exe
3452	msedge.exe
3452	msedge.exe
3452	msedge.exe
3452	msedge.exe
3452	msedge.exe
3452	msedge.exe
3452	msedge.exe
3452	msedge.exe
3452	msedge.exe
3452	msedge.exe
3452	msedge.exe
3452	msedge.exe

Suspicious use of SendNotifyMessage 16 IoCs

pid	Process
3452	msedge.exe
3452	msedge.exe
3452	msedge.exe
3452	msedge.exe
3452	msedge.exe
3452	msedge.exe
3452	msedge.exe
3452	msedge.exe
3452	msedge.exe
3452	msedge.exe
3452	msedge.exe
3452	msedge.exe
3452	msedge.exe
3452	msedge.exe
3452	msedge.exe
3452	msedge.exe

Suspicious use of WriteProcessMemory 38 IoCs

description	pid	Process	procid_target
PID 3452 wrote to memory of 5136	3452	msedge.exe	80
PID 3452 wrote to memory of 2844	3452	msedge.exe	81
PID 3452 wrote to memory of 5096	3452	msedge.exe	82
PID 3452 wrote to memory of 5096	3452	msedge.exe	82
PID 3452 wrote to memory of 5096	3452	msedge.exe	82
PID 3452 wrote to memory of 3700	3452	msedge.exe	83
PID 3452 wrote to memory of 3700	3452	msedge.exe	83
PID 3452 wrote to memory of 3280	3452	msedge.exe	85
PID 3452 wrote to memory of 4968	3452	msedge.exe	86
PID 3452 wrote to memory of 3280	3452	msedge.exe	85
PID 3452 wrote to memory of 3280	3452	msedge.exe	85
PID 3452 wrote to memory of 4968	3452	msedge.exe	86
PID 3452 wrote to memory of 4968	3452	msedge.exe	86
PID 3452 wrote to memory of 4908	3452	msedge.exe	87
PID 3452 wrote to memory of 2404	3452	msedge.exe	88
PID 3452 wrote to memory of 4908	3452	msedge.exe	87
PID 3452 wrote to memory of 4908	3452	msedge.exe	87
PID 3452 wrote to memory of 4228	3452	msedge.exe	89
PID 3452 wrote to memory of 1128	3452	msedge.exe	90
PID 3452 wrote to memory of 2404	3452	msedge.exe	88
PID 3452 wrote to memory of 2404	3452	msedge.exe	88
PID 3452 wrote to memory of 4228	3452	msedge.exe	89
PID 3452 wrote to memory of 4228	3452	msedge.exe	89
PID 3452 wrote to memory of 1128	3452	msedge.exe	90
PID 3452 wrote to memory of 1128	3452	msedge.exe	90
PID 3452 wrote to memory of 5236	3452	msedge.exe	93
PID 3452 wrote to memory of 5248	3452	msedge.exe	94
PID 3452 wrote to memory of 5236	3452	msedge.exe	93
PID 3452 wrote to memory of 5248	3452	msedge.exe	94
PID 3452 wrote to memory of 5512	3452	msedge.exe	96
PID 3452 wrote to memory of 5492	3452	msedge.exe	97
PID 5492 wrote to memory of 2352	5492	msedge.exe	98
PID 3452 wrote to memory of 1368	3452	msedge.exe	99
PID 3452 wrote to memory of 5968	3452	msedge.exe	100
PID 3452 wrote to memory of 1116	3452	msedge.exe	101
PID 3452 wrote to memory of 4944	3452	msedge.exe	102
PID 3452 wrote to memory of 4944	3452	msedge.exe	102
PID 3452 wrote to memory of 5944	3452	msedge.exe	104

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument C:\Users\Admin\AppData\Local\Temp\1541886677692190840.html
1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3452
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x23c,0x240,0x244,0x238,0x250,0x7ffcae60c188,0x7ffcae60c194,0x7ffcae60c1a0
  2⤵
  PID:5136
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1752,i,12728382857781140446,8796176238435981548,524288 --field-trial-handle=2368,i,15192445187327675361,9896292030561877097,262144 --variations-seed-version --mojo-platform-channel-handle=2408 /prefetch:11
  2⤵
  - System Time Discovery
  PID:2844
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1532,i,5318633849183165164,3090901452259639327,262144 --field-trial-handle=2368,i,15192445187327675361,9896292030561877097,262144 --variations-seed-version --mojo-platform-channel-handle=2364 /prefetch:2
  2⤵
  PID:5096
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2132,i,17763025785586445836,2377932228549283307,524288 --field-trial-handle=2368,i,15192445187327675361,9896292030561877097,262144 --variations-seed-version --mojo-platform-channel-handle=3052 /prefetch:13
  2⤵
  PID:3700
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3420,i,13621574170551079375,123563036181816570,2097152 --field-trial-handle=2368,i,15192445187327675361,9896292030561877097,262144 --variations-seed-version --mojo-platform-channel-handle=3496 /prefetch:1
  2⤵
  PID:3280
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3424,i,11080498889678673218,16568355942979026725,2097152 --field-trial-handle=2368,i,15192445187327675361,9896292030561877097,262144 --variations-seed-version --mojo-platform-channel-handle=3500 /prefetch:1
  2⤵
  PID:4968
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4148,i,4181662057643613169,12056341348626280080,2097152 --field-trial-handle=2368,i,15192445187327675361,9896292030561877097,262144 --variations-seed-version --mojo-platform-channel-handle=4164 /prefetch:1
  2⤵
  PID:4908
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4168,i,17915726611376732790,5872700139336153172,2097152 --field-trial-handle=2368,i,15192445187327675361,9896292030561877097,262144 --variations-seed-version --mojo-platform-channel-handle=4288 /prefetch:9
  2⤵
  PID:2404
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=4236,i,18304069137388234187,15868191946735953849,2097152 --field-trial-handle=2368,i,15192445187327675361,9896292030561877097,262144 --variations-seed-version --mojo-platform-channel-handle=4292 /prefetch:1
  2⤵
  PID:4228
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --always-read-main-dll --metrics-shmem-handle=4248,i,13212359053836251578,1811612961056770414,2097152 --field-trial-handle=2368,i,15192445187327675361,9896292030561877097,262144 --variations-seed-version --mojo-platform-channel-handle=1624 /prefetch:9
  2⤵
  PID:1128
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5296,i,9512130844197206672,14156418125957210955,524288 --field-trial-handle=2368,i,15192445187327675361,9896292030561877097,262144 --variations-seed-version --mojo-platform-channel-handle=3608 /prefetch:14
  2⤵
  PID:5236
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5304,i,4254896728332391072,17794425659933860807,524288 --field-trial-handle=2368,i,15192445187327675361,9896292030561877097,262144 --variations-seed-version --mojo-platform-channel-handle=5324 /prefetch:14
  2⤵
  PID:5248
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6060,i,4955480721561412701,10588066960110110398,524288 --field-trial-handle=2368,i,15192445187327675361,9896292030561877097,262144 --variations-seed-version --mojo-platform-channel-handle=6080 /prefetch:14
  2⤵
  PID:5432
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6060,i,4955480721561412701,10588066960110110398,524288 --field-trial-handle=2368,i,15192445187327675361,9896292030561877097,262144 --variations-seed-version --mojo-platform-channel-handle=6080 /prefetch:14
  2⤵
  PID:5512
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.ProfileImport --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6220,i,16466390796904150376,13267314140528394654,524288 --field-trial-handle=2368,i,15192445187327675361,9896292030561877097,262144 --variations-seed-version --mojo-platform-channel-handle=6228 /prefetch:14
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:5492
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\cookie_exporter.exe
    cookie_exporter.exe --cookie-json=1128
    3⤵
    PID:2352
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1624,i,5331307238862984891,15643802946430316701,524288 --field-trial-handle=2368,i,15192445187327675361,9896292030561877097,262144 --variations-seed-version --mojo-platform-channel-handle=4852 /prefetch:14
  2⤵
  PID:1368
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4340,i,9226891591040426207,11970634644899209194,524288 --field-trial-handle=2368,i,15192445187327675361,9896292030561877097,262144 --variations-seed-version --mojo-platform-channel-handle=4836 /prefetch:14
  2⤵
  PID:5968
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4536,i,2192633181976906312,7920176741295644947,524288 --field-trial-handle=2368,i,15192445187327675361,9896292030561877097,262144 --variations-seed-version --mojo-platform-channel-handle=4296 /prefetch:14
  2⤵
  PID:1116
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5856,i,17091082666908764821,11226230999860758683,524288 --field-trial-handle=2368,i,15192445187327675361,9896292030561877097,262144 --variations-seed-version --mojo-platform-channel-handle=5620 /prefetch:14
  2⤵
  PID:4944
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6436,i,281797605209056923,12295985665610137068,262144 --field-trial-handle=2368,i,15192445187327675361,9896292030561877097,262144 --variations-seed-version --mojo-platform-channel-handle=5584 /prefetch:10
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5944

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:884

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

blocklist

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\blocklist
Size 105KB
SHA256 2bc7f3a4024d9673a2f7a098d546fe1f592a8aa0477eb259121fe80954c2f99d
MD5 403039b77d88ae3c8e79a108e60c95e6
SHA1 478b6a90cbd5967be9b36c911b5a2135e0b7199c
SHA512 fbec8c6863e6042041cea05b5efa69ca53b0340f3bee0900ef55602e442dca5b20c736b16589ad755fc44c45bb2c920ed0e29957fb7ab74fe05e101f104c82fb
SSDEEP 1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P7I:fwUQC5VwBIiElEd2K57P7I
TLSH
T1EEB3B931457E36BF26E93EE828CF1511B84F3912664895D4ABE1FE2C4845E68633CEF4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 0b5dc1bf65a27f8ea20844919d7db192caf7a54fd791434a1304a7df2e9b496f
MD5 5de7bfd3f869f48e7255b6bdc532c4bc
SHA1 c26027eb70bc9887bf69c2b22be60226b685dbae
SHA512 0e6af8c455f57dc816a2c01366f46a0d069e8f41cccb1f7565e2afd873b71ffd5f135649fb4bf44d1a15a9efd68dc59696dc74a971b3483ec9d87a4323b2b4f2
TLSH
T112D08032FB5D6052E7455230D893DF10276644A12C974B41E325C84CD5B80D493C3282
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 e3c932e879f8a7071362a654b47cd73c05f90d7fe66be785d811b84b86743e1b
MD5 8c92d931ed33c3d779a020ae7e111fb4
SHA1 de123f6d92bf24747affe820aaa8be3785388fae
SHA512 5be895d6a61eacf4f3117293636fb4890abbe186ddcbfbb3c8d3aa0fd1aa59519bbdd86e552732d2ded27aae5be1ffb0d6d9f6ccaac824d1b13ed03a12a438dc
TLSH
T13BD08032BB9D6452E7455230D893DF10276644A12C978B42E325C84CD5B90D493C3282
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 e9bc03ece67dd8143d252bfc8b64b7083ca969d63ec621d66e5e78db2931a409
MD5 dc32497d428bc6bd011134d6e8ddff5f
SHA1 c88189ced3a473aadd48d4f5aad8336254ea5b8f
SHA512 f9f4d56dc3e5dc8cf1443387260732b7b9452843e22da19296541963f243cf35bc8c9af769b14ac05e1db60258e842fd83c76c43f3950ea5596d763ea29fe339
TLSH
T17B716F7481BFAE83EF602033E0C202DC35B184994B478ED99A548DB77906BE6FDDB409
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe58bdae.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe58bdae.TMP
Size 3KB
SHA256 c936ccb36beaf5f75971f684c28f6cea74fee2b0b0bc74e1b94a46cb6e49f3e8
MD5 04655386df4584b2cb590e8753032607
SHA1 8e199d58fa23d96eb93cea19f72bc93275753f20
SHA512 065b5ab09f9a382f85ae26fd09a1945a313eb19a8f2f9b7583d39e2988a95c5eab8c60651acf551655ed15b98db16248bbf10e7104327b086cb8d0f35743a334
TLSH
T13B716F3481BFAE83EF602033E0C102DC35B184994B478ED95A548DB77906BE6FDDB408
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 949B
SHA256 7777c5c4f2b4b0c9a64653a885bd3727b7d8e718e909d368b5b7551101b9b3ce
MD5 383c9660509dde7b0b5ab9dba45879b0
SHA1 f9c54e81dd3d5647d84fe45dec93cff50b6a2e42
SHA512 7888136c073201e0d42c6f571ac70ca18523791901ee2f3d16e36cfe0327f0621e28ee6fde92be7d63ab5f9861bac11e3bebd5fdea67587dc46518efb74aea7f
TLSH
T12A117DF3C3D5D9AE890156F05A28AE1BDE1D0606421C7D2685D4EF2BD3E3075E00255B
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 ac20d1dfd4a9da1d5524cd2c0cdaf88cfbd696094e09ddbc0e703c9e13d6c467
MD5 9e963e7b0d9261ff004ef0e713ca27c3
SHA1 ff3f35bb509bd284a99f564345c603d3be315072
SHA512 d75ec32d3d57807fc53455249af2c2454144a0a8c04cd749700ea75657cfb34559c9e3f323b5d5d0cebc624b202e6d1809f6382a2d62713a09393bd87a8a36e8
SSDEEP 192:sxZsRoyM/jK1Ml8UQYFo/fCsDQhIdpEb/W6+WNGY0oEQm+FIg5cAJ:sxZs+qOo/fCsDQKG/bG5zQD
TLSH
T18D52F901AA34A977CCDBD209FA55BF53D6F9147392901E48A9FCCA1C01E6AED2217C1F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 f8e9a96e5eddc01c5f85d15a914dfbcbbbbb4a2ed5638cda81054d3e5068940c
MD5 e9e35bf45e2bc2938fd3472ee1e4cd4d
SHA1 f9c0f3b5f1708e84b51b223167fabba05bfa0b84
SHA512 21c87f615c678f493c50504f2c14fb5336bb8d07a6b20697bc039fda30a4e2db6cc38c537e7aa7677c7188a6dcb4b5dde81ce35463ed64dfe911bc166a8797e4
SSDEEP 192:sxZsRoyM/jK1Ml8MFo/fCs4shIdpyb/W6+WNGY0oGXj+FIgrJ:sxZs+do/fCs4sKM/bG5xQ9
TLSH
T1FF42E7016A34A977CCDBD209FA55BF53D6F91573A2901E48A9FCCA1C00E6AED2217C1F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 31KB
SHA256 0953b4777c7c186f4c2b87fc94aceaab01738e4ba92974c3054fad63ccadc326
MD5 3c6194e77273b011df706ed3a8dc2304
SHA1 db705349916d5fb27c903b079d07a4fe39c2bc99
SHA512 39a5979b77501a5980c254739207b2af2829c25a7eeddb045bf24b370416aa73560c06f084ac16d979005ad9339d31cfbf15330873ffffef396761a5ab323264
SSDEEP 768:HZc0s8Ww2YfWRm/JQg18F1+UoAYDCx9Tuqh0VfUC9xbog/OV3BOLl/TB0Ozero+8:HZc0s8Ww2YfWRm/JQg1u1jaKBOLpTuOB
TLSH
T159E21A3B284CCB7E4F840E9DEC26AF966ED801CB66684D5447FE494C03C77EA521A49F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 ada4e7dae4fa01fe13bacc9d8c766186d0fc740a5fcf5d71b98ead28d8eeadaf
MD5 6a0df278b60bda33afe3b3a38e2b9b8e
SHA1 c33d79f7f7683771d234015ef9b616382e414f16
SHA512 0f20df142b1cd849f6e902ecc8169316e49c60fc6cf21f2eb1cc4e9f668089b21779c4958b9ebe0b0870ba8d37597735d0dc8bf99e0dc73c5f48e0f4daf5b984
SSDEEP 48:KkWI3K/q8Ly5oITKhSEHy5OIPKzy4r2t4Em0s:KkWwK/qiaogKhSWaOEKzyq2t4Em0s
TLSH
T130914B4231BA02523D3E290DA2D5DF565685B1933074F42B77D904B21EA7E642FFD8CD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig~RFe595828.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig~RFe595828.TMP
Size 3KB
SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
MD5 904e6e94a1d46374c8630cfd86cc729f
SHA1 e1d9c3f7813878acc6510d48d95b2bf48b2e1a0d
SHA512 081e2a26252860ff8d8f7a9d0378ae56f0cc50574d13d2a121afdf74284963747ef874a4d73b1df7774cd8570972f4f513eefe0a0325fd088556d5b1ba946712
TLSH
T1DB815C4FCC0CBE77ABAB6A719A35D6B2F79131EA94518A977F8C444EE3050ED0242E50
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 14KB
SHA256 386b1cbc07b509104590bc603c3ff189a1869392604d35da640ebed132e1f7bb
MD5 6759055a8a23f86473758d6d7b65629a
SHA1 4022bc53156b36e0d6d812465885ea27e02cc5ea
SHA512 eb5e1de3c53e08d7ef256a104989ac1fc8b3688b78b65aead1119e0c46f1de178f63923f7d3358326b8cbbacca763385237bb7cae4ea6ced2853a5b5af928b44
SSDEEP 192:uxr8NSULQVAb/v2P9VrQmiU1s1T4JSufoPxzYSSus6nIms4SuyRFhsqO++HBHtnv:y8NSULdGX2cUu8YtusnjuIP+HBbsZI
TLSH
T130625CB66C6CEC775DA3A149F64736139FB4406BAA883F4496EC6F1C01DE29C231BD12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 17KB
SHA256 ed668b3c29a32e04dc2ce5a814aa3c2b31b10aad1d89d4908c3e41c52b4ec3dc
MD5 218cc6e63fefee771fbcfeed870a3049
SHA1 e825f34ef17d6a83abe15783837ed7f03d81befe
SHA512 71f51fa14bf702ea1f2f99f725f2c257a13f623b272e007a4fbf9519a7604dd9dad30aa5384fd40cc20dfeb0c00a6b1e716c3119407182712b4958362c926278
SSDEEP 384:xiFR8N38TUNTUlIl0dGX2cUu8YtusnjuU+P+HBbsZI:YFRuwgmdCt1njj+PgcI
TLSH
T18D8229B75C58EC7BAEA69A48FA4A3213DFB4406BD9857E54E3D86E1C009B1DC230BD11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 17KB
SHA256 e6b4cb2dd93b7f9444d9ea9616971b105f7878942447027e33bf732b0fd0361d
MD5 c0f9cec4b73eaaa4f6229e8f48437380
SHA1 a0ebabc2c6882a36762971176746dc580a7fe6d4
SHA512 d12fda8e350358a8e1c5c6090f521a7580ccf38770a361fa8ec1743a295c68e131d3262ac1ed97d1bf7079cdac03e0bac5557380b6ea6e92f73234e4bf0e795c
SSDEEP 384:xiFR8Nk8TUNTUlIl0dGX2cUu8YtusnjurxP+HBbsZI:YFRvwgmdCt1njAxPgcI
TLSH
T1F8822AB79C58EC7BAEA69A44FA4A3213DFB4406BD9857F54E3D86E1C009B1DC230BD11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 14KB
SHA256 f992146d39e277d2641ba5ab1edc7d2d03bd6c25f82ec2d2207cad0122a48839
MD5 1e28aa54dfc1f2ab175085e3fc521559
SHA1 b83c7b30c5cf795d8a286e5b3a01c2b7136eef21
SHA512 d09161c39f14130f3290f710e4a23ac57aca461a5d20051ec9f407bf257f4e3ce005f770e7df68b747681590c95bb4d5546bb3bd780a57ef01455941b1607551
SSDEEP 192:ukd8NSUYLQVAb/v2P9VrQmiU1s1T4JSufoPxzYSSus6nIms4SuyRFhsqO++HBHtv:j8NSU0dGX2cUu8YtusnjuIP+HBbsZI
TLSH
T14F625CB66C6CEC775DA3A149F64736139FB4405BAA883F4496EC6F1C01DE29C230BD26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 98070045498ca4538c8888d36f7c4853b479c312a677e6f196861b84937172d3
MD5 5901b29434026d155848a956d8adeac8
SHA1 ca5540f2e6224068b8abc9d59a005dc62dc356c5
SHA512 7be6e1e4ed536c5ca32592e13174cf4ab73af96ff6d2fe850dac504dc65fb021f13dfaf7699f7f23996aa08bf8ba4a41c205295e2f7f167616b22f2a6c682859
SSDEEP 192:XGNL6jCQmiUyeIjf4SufoPxzYSSus6nImsCSnrxDU6:XGNL6qJcfju8YtusnflDU6
TLSH
T1F502C974AC6C7C6BAFB36E45FA873B135FA4212BD9852F44DAE81E1C00D765C2346836
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 d5a9710e865d7eec3ca101d3dc01e9e75368dc7b3e0150a6aa5c68349b55aeb7
MD5 7e84abfdabbbe90ebe5789573363445f
SHA1 be18a8430f5b4263a2ae8ecc3161c4d6646cc9ba
SHA512 696ad53fe22d6540370496a1cb2fda1bd213ffbc7cd2df28ad78424e7b707db197493d45fe7be7efabd9ac0d7880b214fd14dc9fe29857dc98ab1da8677768e3
SSDEEP 192:0GNA6j9QmiUy/jM4SufoPxzYSSus6nIms4SuyAOMsqO+U6:0GNA6naMju8YtusnjudPU6
TLSH
T1B6121975686CBC6B6EA37594F68736139FB4112BEE857F44C6EC2E1C01DE65C230AC22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 14KB
SHA256 ba60f14d1a621fa110ff89497d41405d7746c29bbeabf2623b12090e78447807
MD5 1d3f2374a8aa0ab00d4d6a854d295146
SHA1 c67f714d2e18d38fdb2ec8429af1049554cfef82
SHA512 d953fb7b3716f08bd94ef6c810cf380ac4e85fb7d48635629fbd150984a975ea38e4024b733c35a7a40f0dcd77359589b3275a8436d4ce98fa43ed15ee8ee68e
SSDEEP 192:uxd8NSUYiQVAb/v2P9VrQmiU1s1T4JSufoPxzYSSus6nIms4SuyRFhsqO++HBHtv:i8NSU/dGX2cUu8YtusnjuIP+HBbsZI
TLSH
T13A625BB66C6CEC775DA3A149F64736139FB4405BAA883F4496EC6F1C01DE29C230BD26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\metadata.json
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download