492db78732ee04bb805266d9e2169cc5a75ee89abfe70d6f0fb64388911b1d38

Analysis

user interaction
yes
max time kernel
149s
max time network
150s
platform
windows11-21h2_x64
resource
win11-20260513-en
resource tags

arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
27/08/2026, 22:20

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
self-leak-main/index.html
Size 360B
Sample260827-188tls1drd
SHA256 492db78732ee04bb805266d9e2169cc5a75ee89abfe70d6f0fb64388911b1d38
MD5 b38d69096686cceb2eac29a25703298c
SHA1 ac0499f68cbcdf6c45e12a86d01a05d64f089242
SHA512 bacf321ece0d9d7962b9206dfc5266f8515a23f9bee942f88876b8ff3adef3a89dc8774641637dfd0a91d72a8fb88317fa477970a250dd5d05d38515dd326aa4
TLSH
T1A9E0C082C4F0CD05622046746ED1F1084E85C2C797846C0436CA60764FC1B91CED72DC
MD5 SHA1 SHA512 TLSH

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
3844	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134323428376421277"	msedge.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2746394149-3500112804-1243524366-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2746394149-3500112804-1243524366-1000\{79FC2D5B-CB0D-442C-985C-C5DF641FE7B0}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
5024	msedge.exe
5024	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 3 IoCs

pid	Process
5340	msedge.exe
5340	msedge.exe
5340	msedge.exe

Suspicious use of FindShellTrayWindow 33 IoCs

pid	Process
5340	msedge.exe
5340	msedge.exe
5340	msedge.exe
5340	msedge.exe
5340	msedge.exe
5340	msedge.exe
5340	msedge.exe
5340	msedge.exe
5340	msedge.exe
5340	msedge.exe
5340	msedge.exe
5340	msedge.exe
5340	msedge.exe
5340	msedge.exe
5340	msedge.exe
5340	msedge.exe
5340	msedge.exe
5340	msedge.exe
5340	msedge.exe
5340	msedge.exe
5340	msedge.exe
5340	msedge.exe
5340	msedge.exe
5340	msedge.exe
5340	msedge.exe
5340	msedge.exe
5340	msedge.exe
5340	msedge.exe
5340	msedge.exe
5340	msedge.exe
5340	msedge.exe
5340	msedge.exe
5340	msedge.exe

Suspicious use of SendNotifyMessage 16 IoCs

pid	Process
5340	msedge.exe
5340	msedge.exe
5340	msedge.exe
5340	msedge.exe
5340	msedge.exe
5340	msedge.exe
5340	msedge.exe
5340	msedge.exe
5340	msedge.exe
5340	msedge.exe
5340	msedge.exe
5340	msedge.exe
5340	msedge.exe
5340	msedge.exe
5340	msedge.exe
5340	msedge.exe

Suspicious use of WriteProcessMemory 26 IoCs

description	pid	Process	procid_target
PID 5340 wrote to memory of 4828	5340	msedge.exe	80
PID 5340 wrote to memory of 1296	5340	msedge.exe	82
PID 5340 wrote to memory of 3844	5340	msedge.exe	81
PID 5340 wrote to memory of 1296	5340	msedge.exe	82
PID 5340 wrote to memory of 1296	5340	msedge.exe	82
PID 5340 wrote to memory of 5436	5340	msedge.exe	84
PID 5340 wrote to memory of 5436	5340	msedge.exe	84
PID 5340 wrote to memory of 1404	5340	msedge.exe	85
PID 5340 wrote to memory of 3600	5340	msedge.exe	86
PID 5340 wrote to memory of 1404	5340	msedge.exe	85
PID 5340 wrote to memory of 1404	5340	msedge.exe	85
PID 5340 wrote to memory of 3600	5340	msedge.exe	86
PID 5340 wrote to memory of 3600	5340	msedge.exe	86
PID 5340 wrote to memory of 2512	5340	msedge.exe	89
PID 5340 wrote to memory of 5384	5340	msedge.exe	88
PID 5340 wrote to memory of 2512	5340	msedge.exe	89
PID 5340 wrote to memory of 5384	5340	msedge.exe	88
PID 5340 wrote to memory of 5096	5340	msedge.exe	90
PID 5340 wrote to memory of 1712	5340	msedge.exe	92
PID 5096 wrote to memory of 2136	5096	msedge.exe	93
PID 5340 wrote to memory of 5944	5340	msedge.exe	98
PID 5340 wrote to memory of 3960	5340	msedge.exe	99
PID 5340 wrote to memory of 5832	5340	msedge.exe	100
PID 5340 wrote to memory of 472	5340	msedge.exe	102
PID 5340 wrote to memory of 472	5340	msedge.exe	102
PID 5340 wrote to memory of 5024	5340	msedge.exe	104

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument C:\Users\Admin\AppData\Local\Temp\self-leak-main\index.html
1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:5340
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x23c,0x240,0x244,0x238,0x280,0x7ffbb11dc188,0x7ffbb11dc194,0x7ffbb11dc1a0
  2⤵
  PID:4828
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1740,i,12319955129909382322,16284385093949454720,524288 --field-trial-handle=2164,i,2585410854191198985,13273021462213916544,262144 --variations-seed-version --mojo-platform-channel-handle=2192 /prefetch:11
  2⤵
  - System Time Discovery
  PID:3844
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1512,i,8560859903671692293,7008224931216199472,262144 --field-trial-handle=2164,i,2585410854191198985,13273021462213916544,262144 --variations-seed-version --mojo-platform-channel-handle=2160 /prefetch:2
  2⤵
  PID:1296
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2424,i,3962967974451108856,13172096916575535335,524288 --field-trial-handle=2164,i,2585410854191198985,13273021462213916544,262144 --variations-seed-version --mojo-platform-channel-handle=3156 /prefetch:13
  2⤵
  PID:5436
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3476,i,6204297795250560508,16103825982535922375,2097152 --field-trial-handle=2164,i,2585410854191198985,13273021462213916544,262144 --variations-seed-version --mojo-platform-channel-handle=3544 /prefetch:1
  2⤵
  PID:1404
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3480,i,12481061483749042537,14915738236692136945,2097152 --field-trial-handle=2164,i,2585410854191198985,13273021462213916544,262144 --variations-seed-version --mojo-platform-channel-handle=3440 /prefetch:1
  2⤵
  PID:3600
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4928,i,11222900861975101158,6255296603252088306,524288 --field-trial-handle=2164,i,2585410854191198985,13273021462213916544,262144 --variations-seed-version --mojo-platform-channel-handle=4988 /prefetch:14
  2⤵
  PID:5384
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4932,i,6437466885756014301,1770566493905421514,524288 --field-trial-handle=2164,i,2585410854191198985,13273021462213916544,262144 --variations-seed-version --mojo-platform-channel-handle=4980 /prefetch:14
  2⤵
  PID:2512
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.ProfileImport --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5864,i,12270941816531411762,3247093932859535488,524288 --field-trial-handle=2164,i,2585410854191198985,13273021462213916544,262144 --variations-seed-version --mojo-platform-channel-handle=5836 /prefetch:14
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:5096
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\cookie_exporter.exe
    cookie_exporter.exe --cookie-json=1128
    3⤵
    PID:2136
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5876,i,10005483862524171162,15981886193093325023,524288 --field-trial-handle=2164,i,2585410854191198985,13273021462213916544,262144 --variations-seed-version --mojo-platform-channel-handle=5892 /prefetch:14
  2⤵
  PID:5672
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5876,i,10005483862524171162,15981886193093325023,524288 --field-trial-handle=2164,i,2585410854191198985,13273021462213916544,262144 --variations-seed-version --mojo-platform-channel-handle=5892 /prefetch:14
  2⤵
  PID:1712
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6240,i,1656021807858752906,10948420490428209618,524288 --field-trial-handle=2164,i,2585410854191198985,13273021462213916544,262144 --variations-seed-version --mojo-platform-channel-handle=5976 /prefetch:14
  2⤵
  PID:5944
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5980,i,16507562491100595010,11206262065467069075,524288 --field-trial-handle=2164,i,2585410854191198985,13273021462213916544,262144 --variations-seed-version --mojo-platform-channel-handle=6424 /prefetch:14
  2⤵
  PID:3960
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5984,i,2139568237397935995,16007308945765101728,524288 --field-trial-handle=2164,i,2585410854191198985,13273021462213916544,262144 --variations-seed-version --mojo-platform-channel-handle=6340 /prefetch:14
  2⤵
  PID:5832
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6256,i,13549719952914726066,8100727098767801570,524288 --field-trial-handle=2164,i,2585410854191198985,13273021462213916544,262144 --variations-seed-version --mojo-platform-channel-handle=6420 /prefetch:14
  2⤵
  PID:472
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=2028,i,5726152439473870971,11842678143160607715,262144 --field-trial-handle=2164,i,2585410854191198985,13273021462213916544,262144 --variations-seed-version --mojo-platform-channel-handle=2040 /prefetch:10
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5024

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:3068

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:4348

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:5492

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

91572ba0-1b23-43b1-8fb4-a98948a71646.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\91572ba0-1b23-43b1-8fb4-a98948a71646.tmp
Size 27KB
SHA256 caf847f9bcf667d9dedbc60088bc246d2270bc7a4807937b016acd38f6b76b01
MD5 886f2b06eb8a6e89d759faca4bff54be
SHA1 8967a8271ec3d396f70cb94887b2aa1a9f1a53eb
SHA512 afc1f7f1389d8283abc43042325df7cdf0928104ece2b49f2f51791878f06b3ebce33493b8d2cb5a80aee701acdfcab7361ebe86406df5c93c9da0f9d3fe0006
SSDEEP 384:n52PiFiZcIU38NA8TUNTUlIRwXMXkyVPFozSjkpfb7oBuJAOkaf51u+LBNj5w8HG:lFQU3/wg6DJo4w2uWN5zG
TLSH
T115C24C72DCA4CDB7ACE75ED5A74A7603EEF04163868C9AD4D5D8AD0D00DB1AE130BC1A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 79054d3106248f0ce580d1442e78fcc5cc48ea2a5eb3b58c6aad98c7106da4b2
MD5 89a1e1173735f4835befe22b5e8bb285
SHA1 d6f781e38a6443407276a07888372638a8f2106f
SHA512 1f5c9b3554cf3bce4cd1214982a8df00dcc74324e66dbddb67a94598fbc762dc44d06c78c7a30a27a408611eba6e2715e40527ce854f203815d9515ab7dc00ce
TLSH
T129D0C0363A2D3003D3195331E042C703332704701C43E201E110C00C9D784D1D3C50C3
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 6b09340cb22edbf71e0f90763fd435b35e26e3a84e71f4c033073dc564ceacd0
MD5 de82f6df0733dc6e89fad64d305f5367
SHA1 f27019be86cb5f8ddd353a4dc0ef3c6cfe6da7db
SHA512 b2443f684be01ef337dd32e8e1253d69b81d20f7291a2a1fa8998d0f723bb6bc114ee5bce6cc270ceadc8b45e5d854eb59b93ff60a8a13d338c218e132c169ff
TLSH
T19DD0C0323E293003D3055331E082C703333700701C43E201E150C01C9DB84D1D7C50C3
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BrowsingTopicsState
Size 414B
SHA256 ffbea935d3be7cab197b5df5b3942faf7d78e6c1a0761f2235747eb3661552be
MD5 56378fea7f72ff044f40ced5e7d34be3
SHA1 db234e95109553b5c96d1f2f8af15326b940b0b5
SHA512 df698a6aee323f89eab54591ede0cea8e2e818076a3b61471432466040af1fe84f4b643a6b8926ccf90ef55fc284c887a85bec46d3b17a003cc77b24268afb5c
TLSH
T11AE02BAAC925AC2728FD0B19E4950A46EAA053571680845F3E3E850C8FB473A068981C
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 1KB
SHA256 f37820b657dc1028e4452aac45865db76c9538296ec6e2a3164d40f43e575866
MD5 8ac91ba3c09d7dc5a1c832fce5b668d3
SHA1 3782e67f0f49057eb34fe96cdacc9bdfa7b212ea
SHA512 675f75c0037a22f32a09ad9ab3134efca6ea06c60cff79b473944ec8a6f26fbd88ec3fddb31774e806ce84d70da3b8c9f93ddeed9005a7571737af0c5d003396
TLSH
T1E431B0F783F4856E8A0196F0AA18BE2FCE1D0511432C7D9A89E4AF1B93E3471E141B5F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 15KB
SHA256 186f6b6c9603ab7a465b3e85fb02c57e5c39ca23e3c07dcea5d8c52a5fce3a58
MD5 01c6f02fbdf6dd91e754fba7c1c3175a
SHA1 6bb53113a0f8e33b795afa5979683c55d0920ac0
SHA512 f04722d6232c82a76232b3ab9c1ad27fb71ee5c7c6a44fefaba94560f65bb7783f510c9865c20132d79128df8dbc61d59da98c10ab5008ad7bbc3b73e6e25122
SSDEEP 192:sxZsRCyMqZjK1Ml8UQl2C/fosaCaBE0CXUQzodpEL/W6+WNGY0dmlFUUk+pIg5fo:sxZsvqQC/fosRaK0LTy/bG5QlHk2Vo
TLSH
T1D1620915AA385977CCDBD219F945BF93D3F9152391900E48A9FCCA1C04E7AED221B82F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 0587b060d5606df2ed49b6803d26733976f44a469f823678fd313c4c05e6af7b
MD5 5a8a6b438d731738c544b0ac9bddb496
SHA1 a0aa8dcab8c3b2f0cf8e8672045ba15f60d39f42
SHA512 e3b52fa17c798b7e76ea0dfb895a59f68cd37f9d77aa115347e7c0de6e5caf0fd0fa344de8fd44c1fedbf07945c2516de4979d9085e847d91751400f5456872e
SSDEEP 192:sxZsRCyMqZjK1Ml8M2C/fosaCaBE0CXUQzodpEL/W6+WNGY0dyFUok+pIg5fkJ:sxZsveC/fosRaK0LTy/bG5szk2Vo
TLSH
T16662F9156A385977CCDBD219FA45BF93D3F9152391500E4499FCCA1C04E7AED221782F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 fe73790da7e900a31923fe1f2c803c70a3793f7da04d0ea43192fa51ca4fa3e0
MD5 91f5125ed936f49334a70ed8f3b04ba2
SHA1 d3df3f9613b7165f537266c33e2122febcc30e79
SHA512 8f08156b621e97e7cc2d375caa993f1adc4f83a5756bde6bd6122d7a6619b8c56462365c476722f99d7116d16a9172045512aa021e8309e87882c8a7799c6c67
SSDEEP 192:sxZsRCyMqZjK1Ml8MFC/fos88CDxE0CXUQzodpEL/W6+WNGY0dROok+pIgjkJ:sxZsvdC/fos83D60LTy/bG5rk2jo
TLSH
T18A62F9056A385977CCDBD319FA45BF93D2F9152392904E4499FCCA1C04E7AED221B82F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 31KB
SHA256 203cce1c4bb7086bf045d43912169a83adc65717c7b46dd51e88ab586e835b9e
MD5 c9821a650e1491ab2fab27fefc745a82
SHA1 3ea8a2b8ff01a01991c000fb740f506901f57279
SHA512 ec28c1925e34ca9914b2b22b4d8ebdbc04e95fecb3a0206730cad06b2a23429bff4d7e4a301a29b943a6e02bb5e5710113a1d59e8c719f29fe83597336591358
SSDEEP 768:ciWKy8Eq2+dWRm5rQW78F1+UoAYDCx9Tuqh0VfUC9xbog/OV3TQLl/Ck0sg3ro1A:ciWKy8Eq2+dWRm5rQW7u1jaKTQLpCFsy
TLSH
T117E21A2B280CCB7E4F841E5CEC266F966EE8018B66A84D5447FA494C03C77EB511A4DF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 23KB
SHA256 e7a1ebd4901fa7411414e7986c3e8277416f2c2f9c3f9582ad19bbd31c982661
MD5 6edb595615fa612cb2da1d77e42531ed
SHA1 ab3c277809a985d86c526c212ba9d6e64245d654
SHA512 21f2d8a01a3674f53616501a78867bd9d4e64c40e33d4410fe59d2e8f821591ce692ac183da37be7bb5b2161565297e8f42048c9c2914a396ab41c22077730eb
SSDEEP 384:AFBHhTofhno2mB21q3Llbfe3sLDdeEpYt1UHv741M:AFBHhTofhno2mB21q3Llbfe3sLDdeEpz
TLSH
T112B28F56717B12023C3E290CA7A19B371E8272A33558A96F77B800BA4E67E115DFCDCD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 27KB
SHA256 894e7e6da8ba9de3a48ec10008a6c033eb1364920c0dd655ec417c0f8c1bc0ca
MD5 d05c46672f27225c6e881af77d0ae260
SHA1 2732eb0b90583fab564d81a7fc1295fb9466687a
SHA512 612e2dcd2197a1c31e590a5fced247eec4c5fae0653fc9e53b5fa2a235b30cc4d4f3decc9bdd05126bc884b916f64bcc627880a435012be55aeac8e0e61ed4ed
SSDEEP 384:n2kiF5UZcId38NA8TUNTUlIRcXMXkyVPOozSjkpfb7oBuJAOkafLZu+LBNj5w8HG:2FQd3/wgvDJo4wGuWN5zG
TLSH
T17DC24B72DCA4CDB7ACE78AD5A74A7603DEF04163868C9AD4D5D86D0D00DB1AE030BC2A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 27KB
SHA256 7c8b83d9a21f040f4056e6f8a9e85befcd51ca49e93f29f95c1488b43aa3a0c6
MD5 d3c739893482d42c353ce7aa28dbdcc3
SHA1 89f7b830d97f720e72619a0962b7dc34cb33fd93
SHA512 4d8029e495c0eeccbc11f5f1194d76b8962217d856f1a4aca6f83e275a09920b5fbb7103368cf134cd48fa8e056b47c986de26d704e1ff5a725d83dcd12dc84f
SSDEEP 384:n52PiF5JZcIw38NA8TUNTUlIRcXMXkyVPZozSjkpfb7oBuJAOkaf51u+LBNj5w8m:lFHw3/wguDJo4w2uWN5zG
TLSH
T10DC24C72DCA4CDB7ACE74AD5A74A7603DEF04163968C9AD4D5D86D0D00DB1AE030BC1A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 25KB
SHA256 788e76566c1741ca865ffd64e9e639aa960f9654a581a664dbbbbdde40a88b18
MD5 d60610536abcee01d4314380c8cefd23
SHA1 54278b722a1e266dfb40f2af4212017a70f16eb3
SHA512 26d02116991070fff04688c7f212ae2a58533763a95a424309d334f39572a0b751d4f967dfadcf8419bf5161c431db43de73d72ccf3f50c84ff7df2e6afae48d
SSDEEP 384:n5iiF9CcmyWCs38Np8TUNTUlIxBydvRo3ajkpfb7oBuJAOkB7hkP+lFYS/D4Hy/Y:/Fccps3Cwg0E7Jo4wB7hkoFYS/s
TLSH
T192C23B35EC98CAB7EDEB4FD9E74A7A06EEE00163858859D4DAD81D0D00DB19D130BC1A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 26KB
SHA256 b3e64c8ac8a8cc3c7d90449cf0fb44958f78df3b4314188083df35703c7a4b99
MD5 98d93ab9a28a784364cfbc06636e9451
SHA1 0de5c27e328d393e36370444df4000acc5eda7f0
SHA512 235b35394abef99a395ec83a9bd8b17e4dc0186d61faad359566ccf8457e46cdbcb91753eb12e7de720ec728167f2cc41a8795c8f4daf74f4119a541803d471c
SSDEEP 384:n5aPiF9CcmyWCs38N08TUNTUlIxBydsnLAjjkpfb7oBuJAOkaftuhkP+lFYS/D43:tFccps3Pwg8EJo4wWuhkoFYS/s
TLSH
T140C24A32EC94CEA7ECE64ED5E64A7A07EEE04163868C5AD4DAC81D1D00DF1AD530BC1A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f935d3b7-b3e2-4ef8-b9a3-287c884d2953.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\f935d3b7-b3e2-4ef8-b9a3-287c884d2953.tmp
Size 27KB
SHA256 b4ec7dbc2f5e7beed29c2cb79bfa17d0b36795fde8a5fa761396c91aea41affc
MD5 e1113a05aaf9add1c1d90c2e90ed0e6e
SHA1 af617546ef34d24013519c473c3b350d41d04f31
SHA512 ab46f106a07d86084b9b088a9bdfbcf178347c6c04c13a34eca54aafd3325cbfa5ad682bbcce38772f1fbe8745442b414801f4a011879e19a93c8ddf5e70a058
SSDEEP 384:n2PiF5UZcIY38NA8TUNTUlIRcXMXkyVPOozSjkpfb7oBuJAOkaf5Fu+LBNj5w8HG:XFQY3/wgvDJo4w+uWN5zG
TLSH
T135C24C72DCA4CDB7ACE78AD5E74A7603DEF04163868C9AD4D5D86D0D00DB1AE130BC2A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1712-192-0x00000283866E0000-0x00000283876E0000-memory.dmp

Download