54ecfd46356384c5324db0f9df8fdbb99f37b8dccc87cb98318a85336e5e4a6e

Analysis

max time kernel
148s
max time network
151s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
31/08/2026, 02:19

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
home.html
Size 136KB
Sample260831-cr23qstdme
SHA256 54ecfd46356384c5324db0f9df8fdbb99f37b8dccc87cb98318a85336e5e4a6e
MD5 58a34265ff6c42f6345c8d068388977f
SHA1 9140a6cff63ccbcd0aaacb409909638a3c4a8489
SHA512 e33089ddf004f1664edfc8a16db3db3186692205264d21b724276164c66ecd6ea838eb657bbd2f91877ef02e1c985943154b2f8503c5477ebc0b02e48e358027
SSDEEP 768:wswdkSTnIBtm9WJLHXSRFfaBf7Gaeq9SVVh9eivpYxytw/iSPObfjFwiFka3YS2Z:GjWxOJIJ169bK1f20vQL6
TLSH
T149D3DCB260F500B792A3A1D1A6B56F1EBFC2E617D587050272FC4FD58FABC92B903158
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
6236	msedge.exe

Checks SCSI registry key(s) 3 TTPs 6 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\UpperFilters	msedge.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	msedge.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags	msedge.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\UpperFilters	msedge.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000	msedge.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\ConfigFlags	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134326163841186590"	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1014449518-1831897916-4205727055-1000\{21558B57-34E9-4868-BC7D-56A2BDED3311}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4796	msedge.exe
4796	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
1240	msedge.exe
1240	msedge.exe
1240	msedge.exe
1240	msedge.exe
1240	msedge.exe
1240	msedge.exe
1240	msedge.exe

Suspicious use of FindShellTrayWindow 33 IoCs

pid	Process
1240	msedge.exe
1240	msedge.exe
1240	msedge.exe
1240	msedge.exe
1240	msedge.exe
1240	msedge.exe
1240	msedge.exe
1240	msedge.exe
1240	msedge.exe
1240	msedge.exe
1240	msedge.exe
1240	msedge.exe
1240	msedge.exe
1240	msedge.exe
1240	msedge.exe
1240	msedge.exe
1240	msedge.exe
1240	msedge.exe
1240	msedge.exe
1240	msedge.exe
1240	msedge.exe
1240	msedge.exe
1240	msedge.exe
1240	msedge.exe
1240	msedge.exe
1240	msedge.exe
1240	msedge.exe
1240	msedge.exe
1240	msedge.exe
1240	msedge.exe
1240	msedge.exe
1240	msedge.exe
1240	msedge.exe

Suspicious use of SendNotifyMessage 16 IoCs

pid	Process
1240	msedge.exe
1240	msedge.exe
1240	msedge.exe
1240	msedge.exe
1240	msedge.exe
1240	msedge.exe
1240	msedge.exe
1240	msedge.exe
1240	msedge.exe
1240	msedge.exe
1240	msedge.exe
1240	msedge.exe
1240	msedge.exe
1240	msedge.exe
1240	msedge.exe
1240	msedge.exe

Suspicious use of WriteProcessMemory 36 IoCs

description	pid	Process	procid_target
PID 1240 wrote to memory of 6820	1240	msedge.exe	90
PID 1240 wrote to memory of 6236	1240	msedge.exe	91
PID 1240 wrote to memory of 6780	1240	msedge.exe	92
PID 1240 wrote to memory of 6780	1240	msedge.exe	92
PID 1240 wrote to memory of 1520	1240	msedge.exe	93
PID 1240 wrote to memory of 1520	1240	msedge.exe	93
PID 1240 wrote to memory of 1520	1240	msedge.exe	93
PID 1240 wrote to memory of 6564	1240	msedge.exe	96
PID 1240 wrote to memory of 6564	1240	msedge.exe	96
PID 1240 wrote to memory of 4812	1240	msedge.exe	95
PID 1240 wrote to memory of 6564	1240	msedge.exe	96
PID 1240 wrote to memory of 4812	1240	msedge.exe	95
PID 1240 wrote to memory of 4812	1240	msedge.exe	95
PID 1240 wrote to memory of 4220	1240	msedge.exe	97
PID 1240 wrote to memory of 4220	1240	msedge.exe	97
PID 1240 wrote to memory of 4220	1240	msedge.exe	97
PID 1240 wrote to memory of 5856	1240	msedge.exe	98
PID 1240 wrote to memory of 5856	1240	msedge.exe	98
PID 1240 wrote to memory of 5856	1240	msedge.exe	98
PID 1240 wrote to memory of 3024	1240	msedge.exe	99
PID 1240 wrote to memory of 3024	1240	msedge.exe	99
PID 1240 wrote to memory of 4376	1240	msedge.exe	100
PID 1240 wrote to memory of 4376	1240	msedge.exe	100
PID 1240 wrote to memory of 6528	1240	msedge.exe	102
PID 1240 wrote to memory of 7040	1240	msedge.exe	103
PID 1240 wrote to memory of 6528	1240	msedge.exe	102
PID 1240 wrote to memory of 6528	1240	msedge.exe	102
PID 1240 wrote to memory of 7040	1240	msedge.exe	103
PID 1240 wrote to memory of 7040	1240	msedge.exe	103
PID 1240 wrote to memory of 5628	1240	msedge.exe	104
PID 1240 wrote to memory of 2920	1240	msedge.exe	108
PID 1240 wrote to memory of 5740	1240	msedge.exe	109
PID 1240 wrote to memory of 6808	1240	msedge.exe	110
PID 1240 wrote to memory of 4332	1240	msedge.exe	111
PID 1240 wrote to memory of 4332	1240	msedge.exe	111
PID 1240 wrote to memory of 4796	1240	msedge.exe	113

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument C:\Users\Admin\AppData\Local\Temp\home.html
1⤵
- Checks SCSI registry key(s)
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1240
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x264,0x268,0x26c,0x260,0x2d0,0x7ffd3ecdc188,0x7ffd3ecdc194,0x7ffd3ecdc1a0
  2⤵
  PID:6820
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1844,i,15873542316379836464,10708434669985735126,524288 --field-trial-handle=2504,i,9330917022624056257,14314989740422515259,262144 --variations-seed-version --mojo-platform-channel-handle=2940 /prefetch:11
  2⤵
  - System Time Discovery
  PID:6236
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2268,i,11317939312231634476,9200526342595459909,524288 --field-trial-handle=2504,i,9330917022624056257,14314989740422515259,262144 --variations-seed-version --mojo-platform-channel-handle=3120 /prefetch:13
  2⤵
  PID:6780
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1572,i,5800936161423628774,15137068121917099974,262144 --field-trial-handle=2504,i,9330917022624056257,14314989740422515259,262144 --variations-seed-version --mojo-platform-channel-handle=2500 /prefetch:2
  2⤵
  PID:1520
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3624,i,3201472653019441244,12698134212121775703,2097152 --field-trial-handle=2504,i,9330917022624056257,14314989740422515259,262144 --variations-seed-version --mojo-platform-channel-handle=3696 /prefetch:1
  2⤵
  PID:4812
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3628,i,5509572103339985957,3818122291554630597,2097152 --field-trial-handle=2504,i,9330917022624056257,14314989740422515259,262144 --variations-seed-version --mojo-platform-channel-handle=3704 /prefetch:1
  2⤵
  PID:6564
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=5196,i,1787600080806370577,13076561636088326894,2097152 --field-trial-handle=2504,i,9330917022624056257,14314989740422515259,262144 --variations-seed-version --mojo-platform-channel-handle=5228 /prefetch:1
  2⤵
  PID:4220
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4856,i,959799496368517960,17431411006997163102,2097152 --field-trial-handle=2504,i,9330917022624056257,14314989740422515259,262144 --variations-seed-version --mojo-platform-channel-handle=3812 /prefetch:1
  2⤵
  PID:5856
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5672,i,4751491471917026778,5336812893841925675,524288 --field-trial-handle=2504,i,9330917022624056257,14314989740422515259,262144 --variations-seed-version --mojo-platform-channel-handle=5704 /prefetch:14
  2⤵
  PID:3024
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5676,i,6973064571817364473,10985094812947543066,524288 --field-trial-handle=2504,i,9330917022624056257,14314989740422515259,262144 --variations-seed-version --mojo-platform-channel-handle=5696 /prefetch:14
  2⤵
  PID:4376
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6408,i,8704014105577369761,3162944436383466382,524288 --field-trial-handle=2504,i,9330917022624056257,14314989740422515259,262144 --variations-seed-version --mojo-platform-channel-handle=6428 /prefetch:14
  2⤵
  PID:6980
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --always-read-main-dll --metrics-shmem-handle=6440,i,7427399228718321905,10986125129059706346,2097152 --field-trial-handle=2504,i,9330917022624056257,14314989740422515259,262144 --variations-seed-version --mojo-platform-channel-handle=6484 /prefetch:1
  2⤵
  PID:6528
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --always-read-main-dll --metrics-shmem-handle=6476,i,3075565082702383013,6009288361707999243,2097152 --field-trial-handle=2504,i,9330917022624056257,14314989740422515259,262144 --variations-seed-version --mojo-platform-channel-handle=6444 /prefetch:1
  2⤵
  PID:7040
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6408,i,8704014105577369761,3162944436383466382,524288 --field-trial-handle=2504,i,9330917022624056257,14314989740422515259,262144 --variations-seed-version --mojo-platform-channel-handle=6428 /prefetch:14
  2⤵
  PID:5628
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6424,i,6629260049133268114,1228527716789456713,524288 --field-trial-handle=2504,i,9330917022624056257,14314989740422515259,262144 --variations-seed-version --mojo-platform-channel-handle=6796 /prefetch:14
  2⤵
  PID:2920
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=604,i,8298220871434953751,11735657014146765457,524288 --field-trial-handle=2504,i,9330917022624056257,14314989740422515259,262144 --variations-seed-version --mojo-platform-channel-handle=6464 /prefetch:14
  2⤵
  PID:5740
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6520,i,8121505471635085364,4333337454242901100,524288 --field-trial-handle=2504,i,9330917022624056257,14314989740422515259,262144 --variations-seed-version --mojo-platform-channel-handle=6768 /prefetch:14
  2⤵
  PID:6808
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3364,i,10833179829419921646,5520871220036628524,524288 --field-trial-handle=2504,i,9330917022624056257,14314989740422515259,262144 --variations-seed-version --mojo-platform-channel-handle=6804 /prefetch:14
  2⤵
  PID:4332
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=3808,i,1092279550954307549,10856386346447561568,262144 --field-trial-handle=2504,i,9330917022624056257,14314989740422515259,262144 --variations-seed-version --mojo-platform-channel-handle=7096 /prefetch:10
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4796

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:3864

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:3616

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 e9e31f5fb014f6a7439a4e224bdae6d3d8b22db7c287d9c004b0184cc18e6bf8
MD5 00fe8112e1beaff1b09c3e772b0b70e6
SHA1 1d234f4d61d2fe0153bb63a7a246d37e6fc0aabe
SHA512 aaafc34862d38399e66858477aa9d3d624e9e071371fe2961aac0159845c41dbe1ed0ae62f8b9c52f327e4e4a97abdaf614ae741bcfd2627ec55b1d4f6fb6d74
TLSH
T1EAD08071B7286847D9551931D432CB017A57546365BAD1025160410C6C7BDB553CA155
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 ba1406dd0117e6bb02a18e1f0ca40a20fdf33f68d611dcf6b59a242ae289374a
MD5 8a26ea5cde92773cb558eb116e113216
SHA1 2f807e9fd5e13c4ff550fceca7d90f11683ae33e
SHA512 dca9db1a71d0ad99193f78ee9f9221519b875eb1beb13ebfbd9d64a1b449eb8a027a5b2ceadf9158001b4548f036b26ed4f2c36ce3e8b981af5a54590c0e94a5
TLSH
T1B8D0C030B7286803D5141931D022CB007A17002321BBD1025160C00C2C3BCB163CA141
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BrowsingTopicsState
Size 414B
SHA256 7d4ab02cd88b409a0dc60273c19579344f56674949926ed83ae47c5f1890dc8d
MD5 d1b6f7ed5bf1f1a49b6aa6458c1634a2
SHA1 c185eaf76bb22eed87820b67252cefdb14d3b902
SHA512 5ab4c18a5ef9ef1d38119bf5d8917d32c603f4fd36a81590c4919e1c23c092da38537674c2713f64d4a741c505f5222c8dd4f5d4a887998e5561019abcdf6a28
TLSH
T1DEE0E5B9C862BC271DFD1B18A0545647E740136B3A50894B7A3D812D4FB063B568A85C
MD5 SHA1 SHA512 TLSH

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\temp-index
Size 3KB
SHA256 306ed770bd4b7fd3d398676d42d06072a4e11d97ca6e13fc86eb9e473a878462
MD5 b9d7c491748b144f3a21b36a5608d4a3
SHA1 6888a509400976b3a41f664298fdc2e31da8f0a9
SHA512 5af5c416a899917821f99affd00615e3e45055ef2563cf8508a787498bed90bfdd2f63217b722476465041c727e86df89ccd02eeeb12b972dfc1679463ceadbb
TLSH
T190719190432F6AF1EBA447B13DFD8A447A7498BD720F5EB2C858D17358E736823B2950
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5a02b1.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe5a02b1.TMP
Size 3KB
SHA256 2aaf3c0f4429c7f7d1cf86426e60c9ba115b78c572a3a3e8c5593c04ddfe11a8
MD5 8b36dd6ff90a03daf582e7164f325919
SHA1 e9bb60cb3991c41abd581fa27cdccfa6a67f0e36
SHA512 83b0cd53dcf498383d0b0938aed56e67008278dfa638ef5a6566c366d11c4c8141983de0be1c3ec4f5dec59345b06dbe965d99bc6e776871f3bf2e92c1bf7a42
TLSH
T139615FE0432F1AF1E3A447B53DFD8B89767498B9620F5EA1C854D17758E632823B2860
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 13KB
SHA256 79b75ae425938a08b3fa3b2368dd1103700d284adb735fccb779ef3d9395db6d
MD5 ec55c876070636e937d31210e0a6173f
SHA1 5316a9ac5f16ff35d6e8debd8eb0985d4afdbaa0
SHA512 48242c0073708fc5a33a73027ab002daa5ad745205e809e753d1604c1a465fde7189653257c83c42244155d8dcca91c982ce40a7456f238b1fd194fcd39d070b
SSDEEP 384:D1ua5u4NwrJ9LtsESeuEJaPJfRaVZaiGShiZQCZp4tOCroq4Fo0xiqZ2XWURpqqO:YeDRltw5WOA
TLSH
T11A527EFBC7E4866DC91652F0AB14AE1BCD1A052547383D2AC9E4EF1B93F24B1D1017AE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 16KB
SHA256 0cc1029dff37af71e9ff3aca6166b05b0a56cf82b6f3203588ed3b43e3751ce4
MD5 f0ee174facb0dbde53d42071a27419cd
SHA1 26d4bb2b640b3bce1fa9b50c892bfcd1792213fe
SHA512 1a94133a58b49dd2504da3781eea9a2f6cd3a6977fa2b39e192b467ca158836327b4979f7c947f6277d2e2d8651febb5edb8842664da9c57d7cc60e45fcd7e01
SSDEEP 192:sxRXRXyMqZjK1Ml8wbK/fBsOoNRZWIzoD8pSz2O/g6+WNIYcC4xwCsGQJGeIgj7J:sxRX4lK/fBsOoN/WYi/5IW49sGQBjN
TLSH
T19372E8196D249D7BCDCBD219FA95BF93D2F91123A1905F44AAFC8A1C00E6BED210781F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 16KB
SHA256 62c97f156d57c1f4beacc5dbc2a0d39b2595a35e5cefe05a39724996c3f85ab8
MD5 f64e8d7ee790891276039489a0d5869c
SHA1 fb24616aced19e4df0e5ddb07d73b7f0d4545c43
SHA512 320e5135f9ac8af8a8131e0c4c4da842f1a98977f1e81239f24b4c0f0d7bf3afc38e9aa4f323b583e205da8e06ea187e8378b4744810ef63bc69df2bc95530a0
SSDEEP 192:sxRXRXyMqZjK1Ml8UQjbK/fBsooNRZWIzoD8pSz2O/g6+WNIYcC45/FsGQJGeIgJ:sxRX4q3K/fBsooN/WYi/5IW4vsGQBbN
TLSH
T1FE72E719A9249D7BDCDBD219FA917F93D2F91123A1905F44AAFC8A1C00E77EE210781F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 27KB
SHA256 a4d4b6d728dfc7c536d3d6bcb19fad00638687f76418bbc84d9bf210e4905258
MD5 6f39294cf14ca60e275cfa7cc5358dd1
SHA1 20656405029fa7fa9cb6192130afd97c5fbdfec0
SHA512 c22d3054358983bd8c5a7a39c9e261ba1ef2eb198577010a99472ce441058e643759d9b93918b82c166c1c587eb5437c044cca436c27dbfc7511dad19230e500
SSDEEP 768:Ob4YATWg1NfwB8F1+UoAYDCx9Tuqh0VfUC9xbog/OVBbDwzroT4z:Ob4YATWg1NfwBu1jasHwAUz
TLSH
T142C2EB2B244CCB7E4F844A9DAC29AED76DD801CB9B984D5447EB890C03C67FB521A4DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\b9519f08bf228bba860b403292c15e23d315a0ca\index.txt
Size 102B
SHA256 969f84138c61316e2fbaabba0d14fea52d91a95f5009ceb4824c47093acd88c4
MD5 03de8cabe0c2f5ac82cb56507abd967d
SHA1 9645216df6a11b4cbb909339687bcdb2639d98f3
SHA512 9c515bc15fb65fb691b32c4531157cbfa3bd69d757958492eefa413f5bc8e81a67d35fe40490a3ed2ec514e5e9e47cd49424cd3c7b90de21bff3abfd0444771f
TLSH
T1F8B012F35160A495DF14FAF86C043D7CD14D188C17C3C008D4E0802B7C4A535C05F380
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt~RFe59e555.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\b9519f08bf228bba860b403292c15e23d315a0ca\index.txt~RFe59e555.TMP
Size 109B
SHA256 3b8bae3a9a1343fe7b4947b5599d7d38b204adfc9d8c8117021a09038d85abd0
MD5 02c1e2adb843f3b7466dbf531bf6914a
SHA1 e3a040ccadab6dc919c99aa3ba353d2e87dc183a
SHA512 1290a1191a2ecc5e1cfe0c901d5f4131f412adaa17b0516144c3cfd1ec45e3e224396f068422f097818a73afd801464775c33949715226ca8564ae9253c481f2
TLSH
T11FB092E3516024959B1065E8A8042AAC915D1C4C1BC2C0089490B02B78BA926C15E380
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 72B
SHA256 3cb01a98beee0ec9ea4c15f0477d3d83bae5c98e94a9d4739a33cfb18a456e1b
MD5 6660b6ffdaad310dd40f2118a6ea18da
SHA1 0fce022f4a5a495475b28abfe159ad484b8b2c1d
SHA512 0397cf88e4063adf9fed632ee17611d7b4ba680af0a9a4d393d7ce1ce4abb7c7d9300ef216b79246252cbae432ef8ff56aa692b97e84834356b2e0913954a005
TLSH
T149A00299158E6413C51017B0F24511C83350886202C19B59E8E4909E8D922409245111
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe59e4b9.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe59e4b9.TMP
Size 48B
SHA256 ad602b6c4729c60788663183f229764821d8cbed1ca6d10f5ef4c87a954cfc05
MD5 a913321194538883684b4fbf5af6d283
SHA1 84bd9e0cf639eb4809f9469f6b184de163fd8956
SHA512 e66a134e1161c4a98a8d8d854ccf34e18076a1eba678a72ac6f68c59a2c7cf7d8e63447da74ce5c2471bb71ba6862018456fee742a7fe999bcfc75256fe99e6b
MD5 SHA1 SHA512

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 23KB
SHA256 7bf88d79f8407803b1bb20f483b1e48ac4a7d5f22a76f6e6abd9f1852116f5c9
MD5 009f927ff275404376d5629c602fdec5
SHA1 18fb3bcb89ab04c55023a30e9baa99addb5fca3d
SHA512 aa75594b2429bbd3b0d5264ccfdeccfcda2e8c22e6b226214bde5ed8fb68341720c58604a66b13b064acb5cb5081a92fb2fb84dbf71b7dd814bab1b4464326cc
SSDEEP 384:yv+Rp0nYrnhZZuJCXHnbB1S/HqlcDDRPbIhJ9ftx:yv+Rp0nYrnhZZuJCXHnbB1S/HqlcDDRg
TLSH
T1B8B25F11713F4680387EB90C91B8981F96C2B4637519E52F7BA802A65F67E039DFE8CD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 27KB
SHA256 44f62069b796423091ce98f82d79d2d8cbf7f2c8d9c9e487f7ba1f45c2b7f263
MD5 0d943047e05bbc335873637dc7943955
SHA1 c88116b0ce280efd1d35ad90396ad217fc8a667e
SHA512 69c51a20fad2604d50b342f8f7292db223902863467decf9a9176b174b65c0cb7e49f244524fe6fc78e0ea6304e734397b89e838f0cc86fe3b310fb8e9488229
SSDEEP 384:n2iF1tNn/s3n9Sn8NgA8TUNTUlIRiPvuTHkCEqfbGGj6P57ClAcaTey2vMkEOObS:dF1j+9SXAwgUuAPGmLTeyUE29MW
TLSH
T1A3D25C36EC58CEB7EDE64ED9B74A364AEEE04263858C5AD4D6D95E0C00CB1ED430BC16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 27KB
SHA256 7cb4da8f9d6992441d29d0f1bc2dc3d767243f24460ec475ef18f3af28510fb1
MD5 dec8240355fee75628b4077965ceed03
SHA1 d3cf6ee683888c4007cad82e51e363d7b0e0e087
SHA512 922d5a1eb7128ecd12a19f6e6915582293cf1fbf9332fdef65bb076405c3fb435eef8ccb184718f0aff970cae9a347474b39bd6ce7ddc86956f80efd78d5a7dd
SSDEEP 384:n8iFhZcIR8NLA8TUNTUlIRkPvuTY3CEqfbGGj6P57ClAcaTey2vMOEKuXdptVPAH:nFpRQAwg6uQPGmLTey+ENX3rAH
TLSH
T1D2C25B32DCA4DDB7ECEB4ED5A60A7607EEF44263968C9AD4D5D95E0D008B1DE030BC1A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 24KB
SHA256 b0d1556d20cc10425e6f03205e39dd0b4b15822bf9256e047a629491a5f4586d
MD5 db155245f2332991added5016909a1fa
SHA1 37d3a213a39adb2d508a50e213afdbcd214eca72
SHA512 09a09a1ac26b6429efa3dcb336ecac5d1bc37cda364f77c8c1dcc352c970815b281ea62ed20396dba6cab513dccdb943e04205cd94c4affb34a3c22849b69a6a
SSDEEP 384:n8iF1tNn/s3n9Sr8NLA8TUNTUlIRgPvuTY3CEqfbGGj6P57ClAcaTey2vMOEw7YS:nF1j+9WQAwg6uQPGmLTey+Ew7V
TLSH
T183B23A36E864DEB7EDE64FD9A70A3646DEF44263858C5AD8D6C91D0D00CB1DE030BC16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 32KB
SHA256 606a5cf962ee38caa20d70b7afabd275deb18d31442d88cb038100159af89cf6
MD5 2a281d13924d3fdafd5572b766ea661e
SHA1 3323c3822274d278b7232bbdfc07f91e481dcdc0
SHA512 d5eb9e996c710b478b8f0420886ef7f66032b5e09bc30e99cddd38b2132a361be28836f1304854805df08f6ecf6bafcfee9aa52a17a08a06efeecf68801529f8
SSDEEP 384:nuiFhZcI28NLA8TUNTUlIRkPvuTYKCEqfbGGj6P57ClAcaTey2vp2EKuXdptVPAH:FFp2QAwg6udPGmLTeyhENX3rAH
TLSH
T17AE2B3F198D79976D8AE4B87A73E6E0699FCC113B5885994F7C84D0CCC861BFC30A816
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 27KB
SHA256 893c3e26ea25a93fce2210f6ccb9321c142a014314821b4604453437afa636c0
MD5 67082faf70237512225266c88b2524de
SHA1 e56216166038666b588a41ef8d1eb41a063a810d
SHA512 365cdf08e9a835219ea47f21ac03ca919240aaaaf12cb1d909f0f1e55041afde5d02d58115561865b3dd1da3baddd52bf0b68f73fa26979dfb2412953ef16c69
SSDEEP 384:n0iFhZcIR8NLA8TUNTUlIRkPvuTY3CEqfbGGj6P57ClAcaTey2vMOEKuXdptVPAH:PFpRQAwg6uQPGmLTey+ENX3rAH
TLSH
T1F8C25B32DCA4DDB7ECEA4ED5A60A7607EEF44263968C9AD4D5D95E0D008B1DE030FC1A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 26KB
SHA256 bb0d89f6c36fe86fd7a7403a5933ff0ca394ee17acd67211d98bee5156d95e03
MD5 6f1737be3fd77be563de19acf89319c6
SHA1 e8f2eb16a6e412e1768819c1081c3d852c42a78d
SHA512 9705537afec03f916729fa16263cd86f3a7f3d5362f5ccbcc18b9186492e4598bfa738f1ba03de06e1a448a6d343e30bdc9de4e6a37cfa2ed3883bb4fe86c36d
SSDEEP 384:n7iF1tNn/s3n9Sn8Ngm8TUNTUlIRiPvuTuKREqfbGGj6P57ClAcaTZL4OObjI9GK:WF1j+9SXmwgUuzqGmLT1429MW
TLSH
T1CFC25B36EC69CEB7EDE74F99B74A3A4AEEE01267849C59D8D6D85E0C00872DD0307C16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download