3ef6d82ad5376688e582a3002b482a99725458fabd45441277045f653f9897e9

Analysis

max time kernel
149s
max time network
149s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
26/08/2026, 12:31

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
index.html
Size 418KB
Sample260826-pp7xeswwbv
SHA256 3ef6d82ad5376688e582a3002b482a99725458fabd45441277045f653f9897e9
MD5 68d575a52223d185ccf175395e1ae96e
SHA1 8993304d5a81ea96a08e9dee1c57aad481e4b8ec
SHA512 826c52f4c5996c43ad88e582ee92b6dcef2046869f16741ab85a756b0c0f6ace026c8c07b5dbb33a4682a5c1f9b8bba2e25f99294225ccad8201c6ee35949bea
SSDEEP 3072:yE5vfwUMyz75fWBH1fbvABI3LTxfgm7pw:yE5vfVz75fKfbvABIfxIm7O
TLSH
T1B194EB63F7F40465120FE2CB1D69FF0A1A63A1179AC2D8857DBE86541F47EE3880B16E
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
3056	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134322210984775932"	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-4046655672-1449839301-2197395821-1000\{B684E1A1-922A-43B0-AB4B-7A71F163A66F}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3668	msedge.exe
3668	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 8 IoCs

pid	Process
3740	msedge.exe
3740	msedge.exe
3740	msedge.exe
3740	msedge.exe
3740	msedge.exe
3740	msedge.exe
3740	msedge.exe
3740	msedge.exe

Suspicious use of FindShellTrayWindow 33 IoCs

pid	Process
3740	msedge.exe
3740	msedge.exe
3740	msedge.exe
3740	msedge.exe
3740	msedge.exe
3740	msedge.exe
3740	msedge.exe
3740	msedge.exe
3740	msedge.exe
3740	msedge.exe
3740	msedge.exe
3740	msedge.exe
3740	msedge.exe
3740	msedge.exe
3740	msedge.exe
3740	msedge.exe
3740	msedge.exe
3740	msedge.exe
3740	msedge.exe
3740	msedge.exe
3740	msedge.exe
3740	msedge.exe
3740	msedge.exe
3740	msedge.exe
3740	msedge.exe
3740	msedge.exe
3740	msedge.exe
3740	msedge.exe
3740	msedge.exe
3740	msedge.exe
3740	msedge.exe
3740	msedge.exe
3740	msedge.exe

Suspicious use of SendNotifyMessage 16 IoCs

pid	Process
3740	msedge.exe
3740	msedge.exe
3740	msedge.exe
3740	msedge.exe
3740	msedge.exe
3740	msedge.exe
3740	msedge.exe
3740	msedge.exe
3740	msedge.exe
3740	msedge.exe
3740	msedge.exe
3740	msedge.exe
3740	msedge.exe
3740	msedge.exe
3740	msedge.exe
3740	msedge.exe

Suspicious use of WriteProcessMemory 41 IoCs

description	pid	Process	procid_target
PID 3740 wrote to memory of 900	3740	msedge.exe	89
PID 3740 wrote to memory of 5472	3740	msedge.exe	91
PID 3740 wrote to memory of 3056	3740	msedge.exe	92
PID 3740 wrote to memory of 5472	3740	msedge.exe	91
PID 3740 wrote to memory of 5472	3740	msedge.exe	91
PID 3740 wrote to memory of 5960	3740	msedge.exe	93
PID 3740 wrote to memory of 5960	3740	msedge.exe	93
PID 3740 wrote to memory of 4528	3740	msedge.exe	95
PID 3740 wrote to memory of 5036	3740	msedge.exe	96
PID 3740 wrote to memory of 4528	3740	msedge.exe	95
PID 3740 wrote to memory of 4528	3740	msedge.exe	95
PID 3740 wrote to memory of 5036	3740	msedge.exe	96
PID 3740 wrote to memory of 5036	3740	msedge.exe	96
PID 3740 wrote to memory of 2368	3740	msedge.exe	97
PID 3740 wrote to memory of 2340	3740	msedge.exe	98
PID 3740 wrote to memory of 2368	3740	msedge.exe	97
PID 3740 wrote to memory of 2368	3740	msedge.exe	97
PID 3740 wrote to memory of 2340	3740	msedge.exe	98
PID 3740 wrote to memory of 2340	3740	msedge.exe	98
PID 3740 wrote to memory of 5052	3740	msedge.exe	100
PID 3740 wrote to memory of 4532	3740	msedge.exe	101
PID 3740 wrote to memory of 5052	3740	msedge.exe	100
PID 3740 wrote to memory of 4532	3740	msedge.exe	101
PID 3740 wrote to memory of 2420	3740	msedge.exe	103
PID 3740 wrote to memory of 2204	3740	msedge.exe	104
PID 3740 wrote to memory of 5564	3740	msedge.exe	105
PID 3740 wrote to memory of 2204	3740	msedge.exe	104
PID 3740 wrote to memory of 2204	3740	msedge.exe	104
PID 3740 wrote to memory of 5564	3740	msedge.exe	105
PID 3740 wrote to memory of 5564	3740	msedge.exe	105
PID 3740 wrote to memory of 2564	3740	msedge.exe	108
PID 3740 wrote to memory of 2564	3740	msedge.exe	108
PID 3740 wrote to memory of 2564	3740	msedge.exe	108
PID 3740 wrote to memory of 4188	3740	msedge.exe	110
PID 3740 wrote to memory of 2012	3740	msedge.exe	111
PID 3740 wrote to memory of 1212	3740	msedge.exe	112
PID 3740 wrote to memory of 3652	3740	msedge.exe	113
PID 3740 wrote to memory of 3652	3740	msedge.exe	113
PID 3740 wrote to memory of 2164	3740	msedge.exe	114
PID 3740 wrote to memory of 2164	3740	msedge.exe	114
PID 3740 wrote to memory of 3668	3740	msedge.exe	116

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument C:\Users\Admin\AppData\Local\Temp\index.html
1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3740
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x260,0x264,0x268,0x25c,0x27c,0x7ffba83bc188,0x7ffba83bc194,0x7ffba83bc1a0
  2⤵
  PID:900
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1640,i,656789346643672667,12700031777257133837,262144 --field-trial-handle=2340,i,7879656104083575348,4392069823570326665,262144 --variations-seed-version --mojo-platform-channel-handle=2336 /prefetch:2
  2⤵
  PID:5472
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1936,i,4655360396301193171,16706615165138654876,524288 --field-trial-handle=2340,i,7879656104083575348,4392069823570326665,262144 --variations-seed-version --mojo-platform-channel-handle=2908 /prefetch:11
  2⤵
  - System Time Discovery
  PID:3056
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2300,i,15881353403690288242,10180005310872252794,524288 --field-trial-handle=2340,i,7879656104083575348,4392069823570326665,262144 --variations-seed-version --mojo-platform-channel-handle=3028 /prefetch:13
  2⤵
  PID:5960
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3628,i,7202959313555894811,16918451451334715415,2097152 --field-trial-handle=2340,i,7879656104083575348,4392069823570326665,262144 --variations-seed-version --mojo-platform-channel-handle=3696 /prefetch:1
  2⤵
  PID:4528
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3632,i,17999414858591697526,14674631731583891123,2097152 --field-trial-handle=2340,i,7879656104083575348,4392069823570326665,262144 --variations-seed-version --mojo-platform-channel-handle=3700 /prefetch:1
  2⤵
  PID:5036
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4312,i,6362651651720180258,10230783479338914862,2097152 --field-trial-handle=2340,i,7879656104083575348,4392069823570326665,262144 --variations-seed-version --mojo-platform-channel-handle=4332 /prefetch:1
  2⤵
  PID:2368
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4384,i,15667042522238497433,6423734090035885290,2097152 --field-trial-handle=2340,i,7879656104083575348,4392069823570326665,262144 --variations-seed-version --mojo-platform-channel-handle=4336 /prefetch:9
  2⤵
  PID:2340
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5396,i,3901624398418545240,9164915155763411683,524288 --field-trial-handle=2340,i,7879656104083575348,4392069823570326665,262144 --variations-seed-version --mojo-platform-channel-handle=5444 /prefetch:14
  2⤵
  PID:5052
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5400,i,10281118426203103363,140897522647099643,524288 --field-trial-handle=2340,i,7879656104083575348,4392069823570326665,262144 --variations-seed-version --mojo-platform-channel-handle=5380 /prefetch:14
  2⤵
  PID:4532
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6076,i,14958995729726614121,8514792917759300153,524288 --field-trial-handle=2340,i,7879656104083575348,4392069823570326665,262144 --variations-seed-version --mojo-platform-channel-handle=6092 /prefetch:14
  2⤵
  PID:4184
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6076,i,14958995729726614121,8514792917759300153,524288 --field-trial-handle=2340,i,7879656104083575348,4392069823570326665,262144 --variations-seed-version --mojo-platform-channel-handle=6092 /prefetch:14
  2⤵
  PID:2420
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --always-read-main-dll --metrics-shmem-handle=6192,i,14091937496728416472,18289243097310300979,2097152 --field-trial-handle=2340,i,7879656104083575348,4392069823570326665,262144 --variations-seed-version --mojo-platform-channel-handle=6212 /prefetch:1
  2⤵
  PID:2204
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --always-read-main-dll --metrics-shmem-handle=6232,i,9081487647847877294,5063926401938809410,2097152 --field-trial-handle=2340,i,7879656104083575348,4392069823570326665,262144 --variations-seed-version --mojo-platform-channel-handle=4376 /prefetch:1
  2⤵
  PID:5564
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --always-read-main-dll --metrics-shmem-handle=6184,i,7314920508118694506,3071253452701007618,2097152 --field-trial-handle=2340,i,7879656104083575348,4392069823570326665,262144 --variations-seed-version --mojo-platform-channel-handle=6876 /prefetch:1
  2⤵
  PID:2564
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5152,i,7096579051469027391,6673932429066770769,524288 --field-trial-handle=2340,i,7879656104083575348,4392069823570326665,262144 --variations-seed-version --mojo-platform-channel-handle=5144 /prefetch:14
  2⤵
  PID:4188
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5156,i,12766335747594105112,12291318890370733489,524288 --field-trial-handle=2340,i,7879656104083575348,4392069823570326665,262144 --variations-seed-version --mojo-platform-channel-handle=4540 /prefetch:14
  2⤵
  PID:2012
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5140,i,9039940695706620015,16031476991007325225,524288 --field-trial-handle=2340,i,7879656104083575348,4392069823570326665,262144 --variations-seed-version --mojo-platform-channel-handle=4396 /prefetch:14
  2⤵
  PID:1212
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2936,i,11080849122857704369,18219022765484256069,524288 --field-trial-handle=2340,i,7879656104083575348,4392069823570326665,262144 --variations-seed-version --mojo-platform-channel-handle=5552 /prefetch:14
  2⤵
  PID:3652
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3348,i,15705624388267704652,18334199941374777965,524288 --field-trial-handle=2340,i,7879656104083575348,4392069823570326665,262144 --variations-seed-version --mojo-platform-channel-handle=3556 /prefetch:14
  2⤵
  PID:2164
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6608,i,14587199123653120084,9439649859094772161,262144 --field-trial-handle=2340,i,7879656104083575348,4392069823570326665,262144 --variations-seed-version --mojo-platform-channel-handle=6636 /prefetch:10
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3668

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:4916

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:4212

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 e35119268ad2455b6ec4314361db946ee09b095b28e62d25bbd7542d6be959b9
MD5 5c633da04aeb5bea485c08ea28f57d24
SHA1 1c5287022e764ef0bb6d895cd993be007ab68eba
SHA512 341697613439896bbdc5bae2e067bf2b52fd4ee959460166157f5fcf5f0647d000c9824a7394abad2ea244ee761164649972236a37dd919e413ac011474bb4b7
TLSH
T12DD09B947B50A50CCC41703229E5535579155461581D45450055F0799C646C246175BF
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 e75f270f1371188bd7f350113eee1f4d141652add7af8e5f7af0ab47dac6d1f2
MD5 e0e7da4c84e8882b494037c575bd294c
SHA1 04d43c383ac5d232ee362aad151519414dc6db2b
SHA512 70d9ca23de3befb782d3d04a586490c626e7c63ad00fac39b0fd9adeae2c1d8413a5d2474e847fabb4f48bbf1384f1fcd10e67765d21ed94ac67795b274b3c2e
TLSH
T122D09294BB60A90CCC81B0322AE66355BA1598A1182D868900A5F07A9CA8AC246179AF
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 6907fd91ae1b11a618959a56a25cee86d6a4a7d74bf4fe561a2ed45ffc41475b
MD5 80f204ec318fe41a68b0477db1303d74
SHA1 1a72fcaa0c8b16d9281a736be91e40eb938be6de
SHA512 27e4e48107e9abc31bdd75f2866bd3be9dad88ae2cdef9c9d0dcb849537649b0ca63c2544ada04b7ddc4b212cb9307b42c7753c12ce43906f7791ba8dff177e7
TLSH
T124612B61132E06C5D7A9C5BD10DB98A8FAF7945E3B0F2AE180487CB49B07F0A10C70B7
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe59f6d9.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe59f6d9.TMP
Size 3KB
SHA256 6c44abd5056a175ffe1b4782f83f533902cada432251b8dcc1e33403168e24ba
MD5 bf39c11461c448b7b1ac7047cab8562e
SHA1 ad7c9123d97c418656390b28f76c019ac4056945
SHA512 54e4d229e8640b26cdac040d986fb40e2a7855a100a992b9af2bbbf975c70dfea488d951f8e5968f22a3c23cd3ca0252b67f2409c6c2cd3fc77ee59379ef95a6
TLSH
T1E5513D61131E06C5D7A5C5BD10DB98A9F6F7945E3B0F2AE180887CB49B03F0A10C70B7
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

183ea742-0d99-46d9-9894-2d53197a7a59.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\183ea742-0d99-46d9-9894-2d53197a7a59.tmp
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 5KB
SHA256 dd4aa464945737d933b30d07eed3d16f7992b34ab71efe9ecddb10171c60148c
MD5 746e4a8a5fe95dc76d746e7c090c4aa9
SHA1 db2765b0762394939c8b874e34f3f6e4fda1031d
SHA512 0c8b96f1e6852360a5aeae284903b18d708286f8db8dd000ff0e8e3b2a76d591cd38fe66fdff262908f96cedb91f3c2b1bef6e5ae7ff341c5d0cbc506fd42b34
SSDEEP 96:DvfS2Otuvl5/Eu1xe2VaaiZjhnZgZ7zhPNZcZHW+XWB6zQAgwQ:D3ow9RX3pVaaiZjhnZgZ71PNZcZHW+Xw
TLSH
T13FB19BB6C2E8477E991552F09A256E2ACD1D051A433C3C668DF4BF1BA3F24B1D1026AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 90348d7bace86ba125e081e08d0c7fd618542e4357ef0182926fba4149c92345
MD5 f60b9ab76dbc2a6e2d9f6ba45e8a7f36
SHA1 c58ebfe8de8761e8ef411c35b563a6140cab8095
SHA512 4fa6e64730c1f8cfe374e94e5a9d2d988a8b51cba69b6d1e6d055c986a82b716e860ac29195042aa77a089f1155eebb86f7c2ff96b764b37f36290b4dca3fc3e
SSDEEP 192:sxRmRmbJ/f1sshYKrjDWzoA8p4K/g6+WNIYE42iKhG7IgDOJ:sxRmGJ/f1sshYCH/5Iefm
TLSH
T11A42C716A968AD7B8CC7D21DFA65BF53D2F95132A0D01F48A7FC860C05EBADD220740B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 683aa0d69c23d421f2f944697e617dbe1de882a294e300c65201e77510b5fc72
MD5 8f8cec4b311e98edc5ea6c4d0eb47a77
SHA1 5bb7fb34ed84079005ec212f417a3fa43e0b03ae
SHA512 b28622d2f69256db603f58299b47d1cdc04fe691f4c07c2c642ecf1a8057951f1978cbf3c38d9ecb88acd283d2108e4aa3347244001a1eafc8476f01d2df6312
SSDEEP 192:sxRhRmbJ/f1sg8YKrjDWzoA8p4K/g6+WNIYE/YiKhG7IgIJ:sxRhGJ/f1sg8YCH/5INfs
TLSH
T15A32C7166968AD3B8CC7D21DFA25BF53D6F95132A0D41E48A6FC860C04EB6DD220780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 06c76101daaaebf957bbdab45030bba91b9b946946959bad4f22e15d6491589a
MD5 9f13badfd95764c2b6ef627649571636
SHA1 30d904e2d11dfe12cbd86dbb5fccc3463e370af4
SHA512 ec86499f5117cce5329f50ca90eb9c3483fc507d31e5ec6e31aee90029f83fb59a3dcd0fb28a272bdc637862005e3003e2bee16076ed7c0a01a358ac8cb0e554
SSDEEP 192:sxRmRmbJ/f1ss8YKrjDWzoA8p4K/g6+WNIYE/YiKhG7IgDsJ:sxRmGJ/f1ss8YCH/5I1f8
TLSH
T1EE32B716A968AD3B8CC7D21DFA65BF53D6F95132A0D01E48A6FC860C04EB6DD220740F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 23KB
SHA256 e1457e96f6ea2f7212f834a4ed26440ae810aaaff99cf32c2d0a8cff9c613750
MD5 8f618be9d89b53741fe28d7c8dcaa67c
SHA1 1e8c1933cd9d8a081c8ecf8bcceb1479931f7c34
SHA512 4ecbe7cbc01e3366823af191f8830bece08f83ce443ecc3bac924aed03b39685f5d7724652be93e3e4bd3e3e09cd11822b84d8bebe03fcbbc88d5e691b11e500
SSDEEP 384:0OhQi3gfCtgHZFfqQKhOObJ+UoAYDCx9TuqZz0VfUCh7xbog/OVwY9VHRAProZCQ:0UQi3aWgH7fqQ8F1+UoAYDCx9Tuqh0Vw
TLSH
T183B20B3B604DCB7E4F801AADEC296FD76D9802C796588D4087FE994C03C77EA911A4DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 c659511762650c6567bd4bdd82853b945f4555c353b9a62ace6819e2de8fdd43
MD5 2198b0c6fe825de0a33545f6a30a6775
SHA1 c5d49a754535190c2128907c05fb066b989b9f3d
SHA512 5b89331bbd82c88981f503e78668c8710d2aa20b88343be96b36ad34102e83ec6e7c32466c1daa4500ff74ee3228378aa3e8b681a3c0b294d57c0953897617b5
SSDEEP 96:KRB+PrZ7/LWPM6gTLK4ygdLcBpkXAlhXVFJWx+EgpJK4AgnJcPnmZl627CK44qSo:CB+PrZ7/KPMrTxygd4BpkXAlhXVFkx+c
TLSH
T1E491BA1270BA02843C3F754C95A88C6A8B8234A731A9E5BF37A809552F77F065DFDDC9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

e2a8ca10-3bec-481b-8e45-10fe566347bc.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\e2a8ca10-3bec-481b-8e45-10fe566347bc.tmp
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 c7317d53d6c242ccea3a0800cdb811da4793a33db4084259c34ef2999def421f
MD5 a60f8b5c2439ce11d4cea97ccdbee0fe
SHA1 47ba8397b5b3d85e1094906843ef733c2f678720
SHA512 b2c5e4b97c82888fda6aa8a1410b5ce61679529657e73d883053f90a6c94c9d6915a96de048741e0760ef3b7a29c46d24133c34c6eba90f0da165a73bda4f579
SSDEEP 768:drv+4UNbdX3ZLjqGpXD6GK48dHeByERRFzjK3Yn1:dbsbB3gG56P48dHSyw/R1
TLSH
T1C603BE70A4A8AD774DF7D289B613B653BFF0411781C81BA4C9CD6B8E458A0ED130FD2A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 34KB
SHA256 2f243ae354e5eed761f4781b2de5c20ce5164b38a8d046073a6ba0a007b30dfa
MD5 82198e15b96a1f52d6556c95d05f7b4e
SHA1 f7f6322246696b7852e375c549ea8fa9b8be3066
SHA512 f7fee98d7268e4a5e9fc681e274e4c149f7684502dbfc2dc9ae35243d42bdbc18864d728c6bd948bb0b7feb9eb6e246d0cc4c9a275c30e540659c6c075edf944
SSDEEP 768:wU3yLjqGlXDtGK48dHeByERRFzjK3YnpcrVj:wU3PG1tP48dHSyw/RarVj
TLSH
T182F2AE70A8E59D774CE7D289BA53B613EFF0821791D8AA5485DDAB0E05871AD030FC2E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 34KB
SHA256 0200be22f1edeb33738b17ea4429c1f8d99f648d2aa3aa7a28522da412ac90fa
MD5 352f4d363f441930bd18aecbc5e20195
SHA1 572d37d0316c41c4224b43cba31100cdca202284
SHA512 dbc9a00d9e96a813e6ffe7025bc34779e05c992d26e8e499633474ed8577f1f866a57d0872737d60075c396909ea292f138a3e676a516384ca83c83a03b43e70
SSDEEP 768:aU3TLjqGlXDtGK48dHeByERRFzjK3YnpcrVj:aU3OG1tP48dHSyw/RarVj
TLSH
T1D7F2AE70A8E59D770CE7D289BA53B613EFF0821391D8AA5485DDAB0E05861AD030FC2E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 2b26f33c3587ed1cb8744b37aa4c14432914804986c72a7b468d9015e7c985cc
MD5 5eaaf10fa6c1a3983e39f44b787ab46d
SHA1 742990755c44e047206550991d3f01e8b5688a3b
SHA512 db4c4c8a6bb0cb2ac55f1372f14b17218caf7cc9f49e991192d327e47ce90709b1a9c8c7ac0c121497dfcafc7c571f95f4b9e0f28f0519accfcdd5750229b126
SSDEEP 768:Qrv+4UNbdf3AqGpfDhK48dHeByERRFzjK3YueVH1SCj:QbsbJ3BGlo48dHSyw/MEH1Z
TLSH
T17503BE71A8A85E774CE792897643B657BFF4411382D41BA4C4DD6F4E868B0DC130BD2B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 39KB
SHA256 6cc780a4c161aff5f650da8e67d56fc23cfbb1e0827d0642c36726728719dc82
MD5 bfd5eed099013d7a8c2654610e18b6f8
SHA1 fa3a8b24aec404e67627b8f53f62092309ecf5c0
SHA512 19d6459fc08dcd66d97aa598eb00f2a238f3f1349a4c9ee47f81363ed201b430b4405924a4e3d256b2e878914e2d4a8c538231fbda0f922ef269c7c899b92caa
SSDEEP 768:crv+4UNbdf3SqGB1DUK48dHeByERRFzjK3JneVH1SCj:cbsbJ3DGnx48dHSyw/GEH1Z
TLSH
T1C503BE71A4A89E774DE7D289B543B657BFF4421381C81BA4D4CD6F8E468A0DC130FD2A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 36KB
SHA256 3b205ebf929473f422b700b9afe6874398edfdfba36bfb3582437d1f3944abbc
MD5 5be90763cf91a336e33df3b43e016cd5
SHA1 3405ea72d39a3c7d56ad0bbfee764a5b5dee9361
SHA512 c471e6793012135c3f8d4eac36041fe2b96ff2c0ae90c39511a9dcc7bc8ebfb7c9ce5904eed1cc87c800d98041fa69902ba5ff2ed12ce377f93d6a40532989e1
SSDEEP 768:lAFT43SwgLLjqGlXDROK48dHeByERRFzjK3YnpcrVj:g43RG1RH48dHSyw/RarVj
TLSH
T17DF29E7298D49D774CBBD789BA57B613EEF0416781D4AA64D6CDAA0E01871EC030FC2A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

8fa2e077-23ed-4e96-b091-e8fc5a1747dd.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\8fa2e077-23ed-4e96-b091-e8fc5a1747dd.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download