hxxps://teams[.]microsoft[.]com/meet/221694994007907?p=U4kHmArLOSrUuCHvRv

Analysis

user interaction
yes
max time kernel
149s
max time network
139s
platform
windows11-21h2_x64
resource
win11-20260513-en
resource tags

arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
05/09/2026, 04:27

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://teams.microsoft.com/meet/221694994007907?p=U4kHmArLOSrUuCHvRv
Sample260905-e273vawgre

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
5100	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134330560477886101"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-226940941-599731907-2645636698-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-226940941-599731907-2645636698-1000\{1E7BD6A2-9333-4476-9C95-12390743B31B}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4820	msedge.exe
4820	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
4972	msedge.exe
4972	msedge.exe
4972	msedge.exe
4972	msedge.exe
4972	msedge.exe
4972	msedge.exe

Suspicious use of FindShellTrayWindow 33 IoCs

pid	Process
4972	msedge.exe
4972	msedge.exe
4972	msedge.exe
4972	msedge.exe
4972	msedge.exe
4972	msedge.exe
4972	msedge.exe
4972	msedge.exe
4972	msedge.exe
4972	msedge.exe
4972	msedge.exe
4972	msedge.exe
4972	msedge.exe
4972	msedge.exe
4972	msedge.exe
4972	msedge.exe
4972	msedge.exe
4972	msedge.exe
4972	msedge.exe
4972	msedge.exe
4972	msedge.exe
4972	msedge.exe
4972	msedge.exe
4972	msedge.exe
4972	msedge.exe
4972	msedge.exe
4972	msedge.exe
4972	msedge.exe
4972	msedge.exe
4972	msedge.exe
4972	msedge.exe
4972	msedge.exe
4972	msedge.exe

Suspicious use of SendNotifyMessage 16 IoCs

pid	Process
4972	msedge.exe
4972	msedge.exe
4972	msedge.exe
4972	msedge.exe
4972	msedge.exe
4972	msedge.exe
4972	msedge.exe
4972	msedge.exe
4972	msedge.exe
4972	msedge.exe
4972	msedge.exe
4972	msedge.exe
4972	msedge.exe
4972	msedge.exe
4972	msedge.exe
4972	msedge.exe

Suspicious use of WriteProcessMemory 35 IoCs

description	pid	Process	procid_target
PID 4972 wrote to memory of 3656	4972	msedge.exe	80
PID 4972 wrote to memory of 5100	4972	msedge.exe	81
PID 4972 wrote to memory of 5884	4972	msedge.exe	82
PID 4972 wrote to memory of 5884	4972	msedge.exe	82
PID 4972 wrote to memory of 5884	4972	msedge.exe	82
PID 4972 wrote to memory of 2460	4972	msedge.exe	84
PID 4972 wrote to memory of 2460	4972	msedge.exe	84
PID 4972 wrote to memory of 2420	4972	msedge.exe	85
PID 4972 wrote to memory of 2420	4972	msedge.exe	85
PID 4972 wrote to memory of 1800	4972	msedge.exe	86
PID 4972 wrote to memory of 2420	4972	msedge.exe	85
PID 4972 wrote to memory of 1800	4972	msedge.exe	86
PID 4972 wrote to memory of 1800	4972	msedge.exe	86
PID 4972 wrote to memory of 2352	4972	msedge.exe	88
PID 4972 wrote to memory of 2352	4972	msedge.exe	88
PID 4972 wrote to memory of 2352	4972	msedge.exe	88
PID 4972 wrote to memory of 4384	4972	msedge.exe	89
PID 4972 wrote to memory of 4384	4972	msedge.exe	89
PID 4972 wrote to memory of 4384	4972	msedge.exe	89
PID 4972 wrote to memory of 912	4972	msedge.exe	90
PID 4972 wrote to memory of 912	4972	msedge.exe	90
PID 4972 wrote to memory of 912	4972	msedge.exe	90
PID 4972 wrote to memory of 732	4972	msedge.exe	91
PID 4972 wrote to memory of 2216	4972	msedge.exe	92
PID 4972 wrote to memory of 732	4972	msedge.exe	91
PID 4972 wrote to memory of 2216	4972	msedge.exe	92
PID 4972 wrote to memory of 332	4972	msedge.exe	94
PID 4972 wrote to memory of 4500	4972	msedge.exe	95
PID 4500 wrote to memory of 1988	4500	msedge.exe	96
PID 4972 wrote to memory of 5776	4972	msedge.exe	99
PID 4972 wrote to memory of 5324	4972	msedge.exe	100
PID 4972 wrote to memory of 5288	4972	msedge.exe	101
PID 4972 wrote to memory of 2616	4972	msedge.exe	102
PID 4972 wrote to memory of 2616	4972	msedge.exe	102
PID 4972 wrote to memory of 4820	4972	msedge.exe	104

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://teams.microsoft.com/meet/221694994007907?p=U4kHmArLOSrUuCHvRv
1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4972
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x23c,0x240,0x244,0x238,0x264,0x7ffa02b3c188,0x7ffa02b3c194,0x7ffa02b3c1a0
  2⤵
  PID:3656
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1872,i,16785396179869055670,11994536773148235012,524288 --field-trial-handle=2136,i,1761909749165793090,13883109791994825230,262144 --variations-seed-version --mojo-platform-channel-handle=2176 /prefetch:11
  2⤵
  - System Time Discovery
  PID:5100
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1620,i,5049948960859705719,16547243125678133371,262144 --field-trial-handle=2136,i,1761909749165793090,13883109791994825230,262144 --variations-seed-version --mojo-platform-channel-handle=2108 /prefetch:2
  2⤵
  PID:5884
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2556,i,16223672318991122969,14297840165422263318,524288 --field-trial-handle=2136,i,1761909749165793090,13883109791994825230,262144 --variations-seed-version --mojo-platform-channel-handle=2688 /prefetch:13
  2⤵
  PID:2460
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3452,i,14103932822780200924,9541553247351785828,2097152 --field-trial-handle=2136,i,1761909749165793090,13883109791994825230,262144 --variations-seed-version --mojo-platform-channel-handle=3484 /prefetch:1
  2⤵
  PID:2420
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3436,i,7985317685864037016,12760147168907364970,2097152 --field-trial-handle=2136,i,1761909749165793090,13883109791994825230,262144 --variations-seed-version --mojo-platform-channel-handle=3444 /prefetch:1
  2⤵
  PID:1800
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4812,i,8118048048751137715,15493942438080015360,2097152 --field-trial-handle=2136,i,1761909749165793090,13883109791994825230,262144 --variations-seed-version --mojo-platform-channel-handle=4904 /prefetch:1
  2⤵
  PID:2352
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4928,i,5906559576655201493,7794186138730169030,2097152 --field-trial-handle=2136,i,1761909749165793090,13883109791994825230,262144 --variations-seed-version --mojo-platform-channel-handle=4864 /prefetch:1
  2⤵
  PID:4384
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=4952,i,5046236077933659756,5198183914025833458,2097152 --field-trial-handle=2136,i,1761909749165793090,13883109791994825230,262144 --variations-seed-version --mojo-platform-channel-handle=4896 /prefetch:1
  2⤵
  PID:912
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3516,i,6297256824396311389,4835162128681416548,524288 --field-trial-handle=2136,i,1761909749165793090,13883109791994825230,262144 --variations-seed-version --mojo-platform-channel-handle=3684 /prefetch:14
  2⤵
  PID:732
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3508,i,14919797434836785696,14829717731370568572,524288 --field-trial-handle=2136,i,1761909749165793090,13883109791994825230,262144 --variations-seed-version --mojo-platform-channel-handle=3496 /prefetch:14
  2⤵
  PID:2216
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6016,i,1668024107797508382,10875430609519405011,524288 --field-trial-handle=2136,i,1761909749165793090,13883109791994825230,262144 --variations-seed-version --mojo-platform-channel-handle=6036 /prefetch:14
  2⤵
  PID:592
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6016,i,1668024107797508382,10875430609519405011,524288 --field-trial-handle=2136,i,1761909749165793090,13883109791994825230,262144 --variations-seed-version --mojo-platform-channel-handle=6036 /prefetch:14
  2⤵
  PID:332
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.ProfileImport --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6300,i,6024849590984514360,4822328605215595356,524288 --field-trial-handle=2136,i,1761909749165793090,13883109791994825230,262144 --variations-seed-version --mojo-platform-channel-handle=6304 /prefetch:14
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4500
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\cookie_exporter.exe
    cookie_exporter.exe --cookie-json=1140
    3⤵
    PID:1988
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4820,i,9077644242511924212,465878644637369548,524288 --field-trial-handle=2136,i,1761909749165793090,13883109791994825230,262144 --variations-seed-version --mojo-platform-channel-handle=564 /prefetch:14
  2⤵
  PID:5776
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5296,i,11244671509709491570,3479428599032933050,524288 --field-trial-handle=2136,i,1761909749165793090,13883109791994825230,262144 --variations-seed-version --mojo-platform-channel-handle=5928 /prefetch:14
  2⤵
  PID:5324
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4920,i,12064368911432454840,1172768292609165933,524288 --field-trial-handle=2136,i,1761909749165793090,13883109791994825230,262144 --variations-seed-version --mojo-platform-channel-handle=5976 /prefetch:14
  2⤵
  PID:5288
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5152,i,4976639753929363931,4463941942771531101,524288 --field-trial-handle=2136,i,1761909749165793090,13883109791994825230,262144 --variations-seed-version --mojo-platform-channel-handle=2976 /prefetch:14
  2⤵
  PID:2616
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6612,i,1899455772583894629,3496426368397916,262144 --field-trial-handle=2136,i,1761909749165793090,13883109791994825230,262144 --variations-seed-version --mojo-platform-channel-handle=5056 /prefetch:10
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4820

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:1592

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:5540

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 c17dc8315075bb661bddf6b1efa879b9a3c39af13982f986bd287f5bc861cbdf
MD5 9573474710d1de6302a0d98890d2faae
SHA1 618b9f2079a97625be399f6137e46655659ecff9
SHA512 a345b915a4191d30d0da665ea4f78297c0cd671a5767e05c415403efb649110868fb279d22dc496792452c325e19b00f5e579f6e014a4488c9a4d6fac83d1c46
TLSH
T118D012273B0DB054E7A9C2729613C7921BB6646174434B01E315C95C99B54D412D6183
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 7b9dac8593d827b7b825086ba5eeec776b808b8429eb90a6b645c319ec8f1435
MD5 c16a98ebe36bda7f5aece00f9ac1d0d0
SHA1 ef2e2a8775d1ebc0124f0ba983b6f20777919000
SHA512 148affd9dbe6aaee9070c22e41bc916df527cec5741753ca2733855f500e4eef0a257445d281d79c2449f8265c41b54dd53ffe57650802594b1211b0db611349
TLSH
T1ADD012273B0DA054E7A9C2729613C7921BB6646174434B01E315C95C99B54D412D6183
MD5 SHA1 SHA512 TLSH

Submit Download

735b75fd-5e03-4d64-93ab-86c7b6286685.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\735b75fd-5e03-4d64-93ab-86c7b6286685.tmp
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BrowsingTopicsState
Size 414B
SHA256 ad94485b83d2828f62a90c1caaa66f6a5f417b895cd00d1e075a7f7fd9a8bd1a
MD5 2f6b79249f8e6463bda21d507870bcf5
SHA1 a73140918644fc5dc0b1e31923011f4e521a8c77
SHA512 11c0ad04b95045d4b058fdc5ae2e1258911a1823a863b0230cb0b1e899735fb285c6f9b1639a6dea76644c377125aef77c629cd13b9be8bffb52066e5af1bcbc
TLSH
T13AE0E5AACCA2E83B19FD5B1850505745E74423571B414A0B3A3CC0098FB563E8545C6C
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 2KB
SHA256 79ef4dc7bf4fe77f2fa52d4385eb5f96d45d892277df093f1253e1c838fa1ca2
MD5 24b2c6a682d15c8d786c7a7b1d7595f3
SHA1 2b3f0bbb732d642cae02ee39223b9c4981274d9f
SHA512 b8373fa63ce744301a6699d80aa93bb7aaac9303c09da02d962b895ca9c4e9eb038d50363327427f09f5617c9c242fe077b5c144d13dcfe6054cd023ca50e633
TLSH
T1E1411A875CB28424F3C386F1AECABC48B4A5B9988D931E16448C307FE82032719F30CC
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe586637.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe586637.TMP
Size 2KB
SHA256 ea3603e2c7a2684738f8c15743805ea625bba7f228f4b4f979b1e83f0ff3d611
MD5 f1748b67bd80e78ea88ceb65d9531f2f
SHA1 a230e114e9a5265a4151c1d82509c9bcfb7d383c
SHA512 8d581505772ff5852fb1a7148fda7327cb531cb5da87e018119df154762841c3df5c381a4df8fd401f85a7b7fed07c2fd225826e25a0c93d6a4000d72b3412b2
TLSH
T189411C475DB28464F3C38AF1AECABD59B4A5B5884D931D06448C307FE82432759F30CC
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 03d6966f881678c2256836c2223b242d86ba5dfa3cc0153dfa6de0bb7cd7b315
MD5 76913f6f467c60793e690ebc5eefb03b
SHA1 3e2d90b2975ced033dcab98331b0f3a791518dad
SHA512 e08846339d0c272292e2c4541c6e2047b6de615aeb5c6b77028f0715c33e0b4ad92feaa1e1415918e08a37ae4b930705661da4493f7b3d0ec5d775df834cbe8d
TLSH
T157519CF783B4856EDA1196F0AA18EE2FDF2D0515432C3D5A89E4EE27D3E3471E00265B
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 e1c1a54f9e0c2ea4f4c83891d868e255ba402e81cf6ab15d45fcea0d9598e7b3
MD5 c0caf2f24888ec74a1656de89baa0c0d
SHA1 65a231f74d2639f0f16a1ffdcdd437bb7b764351
SHA512 aeb8f45e85d87c7d9ec5f1d7303f65e2ab668c638a409975684d82c7f582bf6102f17a06988e46268e49ed8c9dbc8e6238aeee478f60566241443b559acaa8b7
TLSH
T17651AFF783B4856EDA1196F09A18EE2FDF2D0515431C3C5A85E4EE27D3E3471E00265B
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 15KB
SHA256 63189b2a89a297eb53adc8348074e00644b6af03d2aa3ed92c7179bea4c2ff5f
MD5 9f597f8524e9ed256bac1b1f221ba673
SHA1 e5ec3e93e16a1d72bf7d21ba5a8f55e8e5b2536b
SHA512 8efe8fd35b6d6f5a3a83f9fa3205c1177b1e2325e8018d65e887994e64ea883730b943139360960672237c48e6b3fc213a19727c4989c4d53686bfca48d0f9cb
SSDEEP 192:sxZ9RIyMqZjK1Ml8UQ4PFv/f6sTLKTG3whzodp5U/W6+WNvgG/Y0heA+RIg5T+BJ:sxZ9Jq4Nv/f6sTLUGW/bD/5Q1+L
TLSH
T1A862D6166A745D77CCDBD219FA45BFA3D2F9157392904E44A9FC8A1C04EB6EC220382F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 1ee5c0092dae0f9c066ecb4da3a91b4c82131ea9fd47a807d1affda8a9ddc9e7
MD5 89201441838945f88b7cc1b60a1c3eae
SHA1 8c1a0ec47c8e0a3762b04593d13dd7cd11816a75
SHA512 638cddbc2b4b9fac880e6244101a25d34faed0c340ed25f7762b9e0ee2a0f1d862374a08b45c4b9d25538cf7d0503833c928a3b765a9d67d662ab061cd06f2af
SSDEEP 192:sxZ9RIyMqZjK1Ml8MFv/f6ssjKTG3whzodp5U/W6+WNvgG/Y0hFARRIgj+BJ:sxZ9Jdv/f6ssjUGW/bD/5aj+L
TLSH
T12C62D8166A745D77CCDBD219F645BF53D2F9157392904E4499FCCA0C04EA6EC220382F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 31KB
SHA256 bb38d2843fac1676545fd1dbf46602eafc3617f0c3745aa49a1031db89ab22d5
MD5 c258ab0ffae4e902108528daa451bbb7
SHA1 94e44101cf4854bc8266cb0bf62310392e8e9398
SHA512 3ec692d2f7ea16ccdd85ca60febe9a9af8d14ee54e97dc94bcb3cae8992bb419a44865ee591a8d960ffbbb2f42a725ba3cb82349855708e5bfdcf7a2377fc549
SSDEEP 768:wQAKq8y028bWRmj1QWT8F1+UoAYDCx9Tuqh0VfUC9xbog/OV3L4Ll/f10EMEroSO:wQAKq8y028bWRmj1QWTu1jaKL4LpfiEC
TLSH
T1FFE21B3B284CCB7E4FC44E9CED276E8769D802CBA7588D5447FA494C03CA3EE511A59B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\2b5c392d2730c0910fd56433cc5e73e510d0f2b4\18ad7faa-bf2b-4168-aa19-bb0bb3d9d406\index-dir\the-real-index
Size 168B
SHA256 4049543b4a96e2e00c6b797f131f2ef2cdeddfcf58a46881a8532213d20fa46a
MD5 df511b6c275d02f90902de6a192e5443
SHA1 376295bcbacc598d511aa369978095c572168564
SHA512 9bd0dcf5f33589c172aed261ea8ebf858113488f44fae098af8abae8bff98ad7324f5aa86ac014ceb368573dbaf93f90142c481ff4450339711efb37b386fc36
TLSH
T18AC02B0846A01920C40F06F6034750513331093B843A8342985D5168EE11C108050213
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe58531c.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\2b5c392d2730c0910fd56433cc5e73e510d0f2b4\18ad7faa-bf2b-4168-aa19-bb0bb3d9d406\index-dir\the-real-index~RFe58531c.TMP
Size 48B
SHA256 a7dfe3d9e2680056f31c88f0872b29a3c40667fd660891ef8a875bea6115b20a
MD5 3ed7945889761e0d8dad54fcab2ef3bd
SHA1 a2ba557cc8b94f2757886a4e8a4ec9d1ed4ec958
SHA512 cd9aa0a0861a54319b24aa76da066023f07ede0e61b3263f094dfaff459e6fb8bb96e41546036e69507e1c54f6b3672c931b2b77302809951fc66afe016581e4
MD5 SHA1 SHA512

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\2b5c392d2730c0910fd56433cc5e73e510d0f2b4\index.txt
Size 155B
SHA256 e28accc148bf734e573533742340c1dbe9ecf01ac88e28ea00797c2716d11921
MD5 c68226adca0c8d0f270e47a760dc2874
SHA1 7dc5c99e00d265ce68ee28c4959e1e170bf6bfe9
SHA512 4264d021013c49a895a3d66f61327b4f1b78b448065a3d4cc4b00ee49a8f055bc87f3cf271abfb389218c23e58ab688b9cef3741ee02d7357512a21303dc48c5
TLSH
T141C08CAA836005099B8853D20094D42B9A0A940B8430F8E451988141282A35DF8439BA
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt~RFe58534b.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\2b5c392d2730c0910fd56433cc5e73e510d0f2b4\index.txt~RFe58534b.TMP
Size 160B
SHA256 bf3b4b392600217f148b12cab41596493825d9489f3e821cb255f61ffb6b8c53
MD5 4e8f5c7d3a987709b53e89471e2abe55
SHA1 e66acfbd8cc6e6edca4302bd2347ba7d51b61ded
SHA512 43cbf71233a1f28304faa6b44ad00e73af35c0dcba5f6496af84d6d83e9f2948cea4d36ee45337f846c038cef244d2a84713b75d4943b82bd345d6d886f14bf5
TLSH
T183C08C6A836005099B8812D200A4E42B98095C0B8820E4E45295B241383A35AF587EBA
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 96B
SHA256 dc1d8d6f4b962ae9f286270829ddebbc8b86d2f6ff1c8379a507942d95f08931
MD5 b04e9bcbf860df634fa793c8a9d348d5
SHA1 7e26b7a35d607dc421fa6f1a0a8a2e41e93988aa
SHA512 7a1de449f623c63c652e92c7962192a030ffa2ba35d990f82c122b8f5c4c63af1af38e5f1fef012ee2553fdbbf816496547b9c9b8ed18d863b1104dd8a34f8c3
TLSH
T124B00162804B614AD48507B0728B245572298E16D7632B2289A0F4ADACA528099A5259
MD5 SHA1 SHA512 TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 22KB
SHA256 eadfd9cd3754bd3cd31c61c18397ffedec4162f64d3eabacd6519b69090394fc
MD5 b55afc849606992be6fa5e7302ef817b
SHA1 9cc3f3d3c798f874786bfd1d64f7af5016a87798
SHA512 451be514f1aeae3789bb1fe40269ab5a3e63a09f49179431ead7deb6dbc2b0be281c2e3ac0389e4f54318ff6b19043c368b0f140a56fd4725872633599daa50e
SSDEEP 192:GD9R5VJhn/iVJnZFGVApBPisTE/3oNloNPSF53pVWFQ5xfSsD0PnY9JFlPtv0F5H:GZLVDJjEDPV0/ZdeDq
TLSH
T1A2A2491232FA02423C7E290C929687674A42F163346DED7F7BA940B54E67E225DFD8CD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 32KB
SHA256 395bc10c9acef123e7de6d479c692783ebb826a89b187df978fd07230dda4cb6
MD5 88dd4c5be42fd8f86cdf5cdeb2405ea5
SHA1 7abe6a03f2b86b2f767e6b5407b4d43c53189feb
SHA512 6a7551bc935165ce21536a8942adaf99181c49f35b6eb39ed449ef07f894481dde585a8a5342d9eb8ce365438cc20661aa4962a43ec58e8188b49283933e3898
SSDEEP 384:n85iFiZcIM8ND8TUNTUlIRbPm3ek32nn9HzTSuf+8G3dj9jq9XfU7O6R2Feoelm/:hFQMAwgFKekmZxGtj9jSfU7TRJS
TLSH
T141E2D5F298D78977E8AE4B87673D2E029AFCC153B6884584B7D85D1DCC861BFC306816
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 25KB
SHA256 d7ddcceb6278a97be7d987d4d9412c0ffdd819b2d4b100fa38fa1b5bd59a13fd
MD5 c36085eec906d7ad2ac6e93784275d85
SHA1 5882dae2b292835c954655873fce7ea82cfac90d
SHA512 c6ec6cf121c6229184decf460d771de066b41321e8773b8f25bc72bcbb3e1dcf90f37ac5e73cc79fea4fc2b9bc33422f8435c8abf89cd918a93bc1ac4eeb2d68
SSDEEP 384:nliF9CcmyWCs38N/8TUNTUlIxBPm3ek32nn949gSuf+8G3dj9jq9X4Ue4KV8p0xW:sFccps3QwgPKekmOcGtj9jS4UI8p0U
TLSH
T1E6C24B32EC64C9BBECE64F98B74A3603DEE05263868C9AD4DADC5D1D009B1DD534BC26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 27KB
SHA256 42a1241a9a04414d81e0306c07ff97ae86e6be479c22a57d51161a858bf39104
MD5 304ea04a8cc5a12d17ea16a224fbc58b
SHA1 4464837b8a5cbf458cfb14b3eb9cfbe01a74e89a
SHA512 49e523b164dddb4171aee523819fb6735826c113b502a2a2bd1ff4aff1418f69c488cc987395511d2fa51fec81e0ebc85c9452879fe7ff004a8d4b01788b5eb0
SSDEEP 384:nXiFiZcI+8ND8TUNTUlIRbPm3ek32nn9saTSuf+8G3dj9jq9XaU7O6R2Feoelmtd:SFQ+AwgFKekmlxGtj9jSaU7TRJS
TLSH
T16EC23A32ECA4C9BBADF68A85A70A7613DEF0516386CC8AD4E9DD5E1D009B5DD030BC16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 24KB
SHA256 18b551d5757f1cb9d1ffd7135c4c93e13a49bab09cc09fcf562605e76337e66f
MD5 dc564b0c4aa49eed5dfa49ecee7e63fc
SHA1 4e564854467a2c7be5d09b0152b797e056c68c4e
SHA512 f08b56a9d0eeec3033e7dfeddd65e35754e551fa38f7d57ec6a86b1733f6e9b8ea32c19e44ac0a1e1f7b46dd0bd990296c462be27787bd1a1ddcf0b9bd6799b8
SSDEEP 384:nDiF9CcmyWCs38NA8TUNTUlIxBPm3ek32nn9BgQ8sSuf+8G3dj9jEBe4KV8p0xr6:uFccps3zwgPKekmoDYGtj9jEBI8p0U
TLSH
T1D1B25B32EC68CABBEDE64F89B70A6603DEE06263858C89D4DED85D1D00871DD134BC27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 27KB
SHA256 c5b73d51c4b63f4f8804899360405000a09494fc2ea828164a01c05098f3610b
MD5 e59e1a3e12eb9524d7191c68c09d2f88
SHA1 97bc0aa1171c7454d27386366f19065c6094f20d
SHA512 26f2d4de28fdf93336fb2117a9f30a681d99790dacad30b17206a141754640108e4e6f172a170be01facb44df578a1cec1e57d27ca08bf1da39643c47916f715
SSDEEP 384:njiFiZcI+8ND8TUNTUlIRbPm3ek32nn9HaTSuf+8G3dj9jq9XaU7O6R2Feoelmtd:OFQ+AwgFKekmYxGtj9jSaU7TRJS
TLSH
T15DC23A32ECA4C9BBADF78A85A70A3613DEF0516386CC8AD4E9DD5E1D009B5DD030BC16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/332-223-0x0000018608930000-0x0000018609930000-memory.dmp

Download