4b94fafbc9642bf9ff76502b4082854630c1b1574a22466b7917290f30ad08a0

Analysis

max time kernel
148s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
07/09/2026, 00:21

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
sample.html
Size 88KB
Sample260907-anhhtadh72
SHA256 4b94fafbc9642bf9ff76502b4082854630c1b1574a22466b7917290f30ad08a0
MD5 3b48491a9653e024d1a5c5225b7c094c
SHA1 0ccaba9748dd451171f6ed887250ec4028e28f28
SHA512 e2fd7299a0e6a569897c6c39d015fdbaa1d5b4a2cd26a5600dbe8f9bb43e935a331e8e0782e566663e1a49b7f7be7338d96606130b2c48800eff9d00ae4ab8cc
SSDEEP 1536:4W++v9Nk3zA2Qt3puvWRCvXV3R1yQZAFo5QqkUn3iG/0K/3MqO38raU1:4W++v9Nk3zA2Qt3puvWRCvXV3RBJ
TLSH
T14E93616052D935AB1B33F1D5EC11BF0EA4D1417CCB272E029AFC19DB4BEAC24EA26457
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4976	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134332140897493244"	msedge.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2370214745-1838013427-2987045292-1000\{BC257008-DE2B-4453-B346-C0C004E8E33C}	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4840	msedge.exe
4840	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
1384	msedge.exe
1384	msedge.exe
1384	msedge.exe
1384	msedge.exe
1384	msedge.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
1384	msedge.exe
1384	msedge.exe
1384	msedge.exe
1384	msedge.exe
1384	msedge.exe
1384	msedge.exe
1384	msedge.exe
1384	msedge.exe
1384	msedge.exe
1384	msedge.exe
1384	msedge.exe
1384	msedge.exe
1384	msedge.exe
1384	msedge.exe
1384	msedge.exe
1384	msedge.exe
1384	msedge.exe
1384	msedge.exe
1384	msedge.exe
1384	msedge.exe
1384	msedge.exe
1384	msedge.exe
1384	msedge.exe
1384	msedge.exe
1384	msedge.exe
1384	msedge.exe
1384	msedge.exe
1384	msedge.exe
1384	msedge.exe
1384	msedge.exe
1384	msedge.exe
1384	msedge.exe
1384	msedge.exe
1384	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
1384	msedge.exe
1384	msedge.exe
1384	msedge.exe
1384	msedge.exe
1384	msedge.exe
1384	msedge.exe
1384	msedge.exe
1384	msedge.exe
1384	msedge.exe
1384	msedge.exe
1384	msedge.exe
1384	msedge.exe
1384	msedge.exe
1384	msedge.exe
1384	msedge.exe
1384	msedge.exe
1384	msedge.exe
1384	msedge.exe
1384	msedge.exe
1384	msedge.exe
1384	msedge.exe
1384	msedge.exe
1384	msedge.exe
1384	msedge.exe
1384	msedge.exe
1384	msedge.exe
1384	msedge.exe
1384	msedge.exe
1384	msedge.exe
1384	msedge.exe
1384	msedge.exe
1384	msedge.exe

Suspicious use of WriteProcessMemory 32 IoCs

description	pid	Process	procid_target
PID 1384 wrote to memory of 2008	1384	msedge.exe	85
PID 1384 wrote to memory of 4976	1384	msedge.exe	86
PID 1384 wrote to memory of 3372	1384	msedge.exe	89
PID 1384 wrote to memory of 3372	1384	msedge.exe	89
PID 1384 wrote to memory of 4732	1384	msedge.exe	87
PID 1384 wrote to memory of 4732	1384	msedge.exe	87
PID 1384 wrote to memory of 4732	1384	msedge.exe	87
PID 1384 wrote to memory of 4576	1384	msedge.exe	90
PID 1384 wrote to memory of 4576	1384	msedge.exe	90
PID 1384 wrote to memory of 4576	1384	msedge.exe	90
PID 1384 wrote to memory of 4524	1384	msedge.exe	91
PID 1384 wrote to memory of 4524	1384	msedge.exe	91
PID 1384 wrote to memory of 4524	1384	msedge.exe	91
PID 1384 wrote to memory of 3184	1384	msedge.exe	92
PID 1384 wrote to memory of 1524	1384	msedge.exe	93
PID 1384 wrote to memory of 3184	1384	msedge.exe	92
PID 1384 wrote to memory of 3184	1384	msedge.exe	92
PID 1384 wrote to memory of 1524	1384	msedge.exe	93
PID 1384 wrote to memory of 1524	1384	msedge.exe	93
PID 1384 wrote to memory of 4880	1384	msedge.exe	97
PID 1384 wrote to memory of 4204	1384	msedge.exe	98
PID 1384 wrote to memory of 4880	1384	msedge.exe	97
PID 1384 wrote to memory of 4204	1384	msedge.exe	98
PID 1384 wrote to memory of 436	1384	msedge.exe	100
PID 1384 wrote to memory of 3196	1384	msedge.exe	104
PID 1384 wrote to memory of 3984	1384	msedge.exe	105
PID 1384 wrote to memory of 4020	1384	msedge.exe	106
PID 1384 wrote to memory of 4528	1384	msedge.exe	111
PID 1384 wrote to memory of 4528	1384	msedge.exe	111
PID 1384 wrote to memory of 1524	1384	msedge.exe	114
PID 1384 wrote to memory of 1524	1384	msedge.exe	114
PID 1384 wrote to memory of 4840	1384	msedge.exe	116

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument C:\Users\Admin\AppData\Local\Temp\sample.html
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1384
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x248,0x7ffa448ec188,0x7ffa448ec194,0x7ffa448ec1a0
  2⤵
  PID:2008
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1788,i,829626247522008087,18224658198830895933,524288 --field-trial-handle=2320,i,18203133006001898364,10147973237803879894,262144 --variations-seed-version --mojo-platform-channel-handle=2364 /prefetch:3
  2⤵
  - System Time Discovery
  PID:4976
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1628,i,13470014451573571221,4121844814999466246,262144 --field-trial-handle=2320,i,18203133006001898364,10147973237803879894,262144 --variations-seed-version --mojo-platform-channel-handle=2316 /prefetch:2
  2⤵
  PID:4732
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2344,i,13224643478928282308,6493457082142082965,524288 --field-trial-handle=2320,i,18203133006001898364,10147973237803879894,262144 --variations-seed-version --mojo-platform-channel-handle=2896 /prefetch:8
  2⤵
  PID:3372
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3468,i,7974867815967078821,16989863258469973103,2097152 --field-trial-handle=2320,i,18203133006001898364,10147973237803879894,262144 --variations-seed-version --mojo-platform-channel-handle=3528 /prefetch:1
  2⤵
  PID:4576
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3472,i,13794705620990266013,15385387224726197099,2097152 --field-trial-handle=2320,i,18203133006001898364,10147973237803879894,262144 --variations-seed-version --mojo-platform-channel-handle=3572 /prefetch:1
  2⤵
  PID:4524
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4128,i,1006987110044487337,546639437733415754,2097152 --field-trial-handle=2320,i,18203133006001898364,10147973237803879894,262144 --variations-seed-version --mojo-platform-channel-handle=4176 /prefetch:1
  2⤵
  PID:3184
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4152,i,10790781736663579926,320114181318770218,2097152 --field-trial-handle=2320,i,18203133006001898364,10147973237803879894,262144 --variations-seed-version --mojo-platform-channel-handle=4204 /prefetch:2
  2⤵
  PID:1524
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5104,i,12527896733290474773,3090163270241877660,524288 --field-trial-handle=2320,i,18203133006001898364,10147973237803879894,262144 --variations-seed-version --mojo-platform-channel-handle=5184 /prefetch:8
  2⤵
  PID:4880
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5112,i,6681116404089903665,13192850430414210898,524288 --field-trial-handle=2320,i,18203133006001898364,10147973237803879894,262144 --variations-seed-version --mojo-platform-channel-handle=5216 /prefetch:8
  2⤵
  PID:4204
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5888,i,13266352809876816652,2226199310588015656,524288 --field-trial-handle=2320,i,18203133006001898364,10147973237803879894,262144 --variations-seed-version --mojo-platform-channel-handle=5908 /prefetch:8
  2⤵
  PID:3300
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5888,i,13266352809876816652,2226199310588015656,524288 --field-trial-handle=2320,i,18203133006001898364,10147973237803879894,262144 --variations-seed-version --mojo-platform-channel-handle=5908 /prefetch:8
  2⤵
  PID:436
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4328,i,17537369872373712080,6873737558625324716,524288 --field-trial-handle=2320,i,18203133006001898364,10147973237803879894,262144 --variations-seed-version --mojo-platform-channel-handle=4312 /prefetch:8
  2⤵
  PID:3196
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5988,i,12143936853876379325,1562928650108352101,524288 --field-trial-handle=2320,i,18203133006001898364,10147973237803879894,262144 --variations-seed-version --mojo-platform-channel-handle=4192 /prefetch:8
  2⤵
  PID:3984
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4152,i,17366693547229226916,14357728054694166109,524288 --field-trial-handle=2320,i,18203133006001898364,10147973237803879894,262144 --variations-seed-version --mojo-platform-channel-handle=6264 /prefetch:8
  2⤵
  PID:4020
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5224,i,786112426960257196,1928398337577111428,524288 --field-trial-handle=2320,i,18203133006001898364,10147973237803879894,262144 --variations-seed-version --mojo-platform-channel-handle=4488 /prefetch:8
  2⤵
  PID:4528
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5848,i,278997956238248778,6682947810705933069,524288 --field-trial-handle=2320,i,18203133006001898364,10147973237803879894,262144 --variations-seed-version --mojo-platform-channel-handle=5844 /prefetch:8
  2⤵
  PID:1524
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1864,i,14026477106558826353,1983704620201627927,262144 --field-trial-handle=2320,i,18203133006001898364,10147973237803879894,262144 --variations-seed-version --mojo-platform-channel-handle=5524 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4840

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:4728

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

blocklist

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\blocklist
Size 105KB
SHA256 ae53e618032c667892ed21a0d220c217b0a8d7911b3dee86b08e6a49f9b5961f
MD5 f9f19468189111f8249d81621e4a102d
SHA1 fa68cce6f26f82bf96fb875ff427a4ef9e9673b2
SHA512 d53cb2328cd19d1ba8512d1ff3633af39c02eed400e5983853154f5b66c3341ed3d1103439b7c80316b2363de07a7530588d76f9e262920e057331d68d3f3bb7
SSDEEP 1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P7h:fwUQC5VwBIiElEd2K57P7h
TLSH
T18DB3B931457E36BF26E93EE828CF1511B84F3912664895D4ABE1FE2C4845E68633CEF4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 39b8627875fea5ac5c5bfb887da12c15116e3fe81f200852c71d5699102c9044
MD5 e3962be2eb3bd350a67bf6309159a1cc
SHA1 c10632202b95ed6f7f4475b6483bf5196e4c5578
SHA512 d12d4acc23b51c071fbc9bf4db2f0575a6b43ec7894b272035e4c01dfce30099cd3ef90a1009dd1e6284cfbcf7a37fd3b79490739946700a2c61ec578374cbe6
TLSH
T173D08C677A0E7815E72F8231A413E360A76B4072A5629702F324C81DA9BC8D85BE63D7
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 a59087fbda784cffb013f4e2a0bf13a7fca483c48e8a7fc15fa022402eb25d72
MD5 dd54db185d82309b854bfa7657ba4600
SHA1 d01c14e8b4dec85ed2e1671545a868fd7ad4fa95
SHA512 f014ab84dd934b90e006883b74ad349d05f60071e57d2cf0bdf8a9bce118654c92139263e082094b602f6900a71e9a7848754994a2ea88642b2376121b581d07
TLSH
T165D08067354D7815E71F42319413D350576B4072A562D702F314C41D957C4D857D53D7
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 8b1caa82390d71fe99afb7a2123246264cbd2d973627db7b7e5b75d108c5ac2d
MD5 73c79c964e24c68eeba6e315597a9317
SHA1 ae80cac61c6cf01fd2f648642cc8ee7853a86ab9
SHA512 ca3589a19e0809b93f93798c7307171ce06e69e4dc6fffce86eb3bb825d29efed85311342fd7cfca5e52fb9c3f4e1d8984fd52c554d5f066919e24e7e72c674e
TLSH
T18E61F9190E15549DEFD31631E5D123B87A74B3878A8FBE55421CC8BD6A35F3286C600C
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5853f7.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe5853f7.TMP
Size 3KB
SHA256 eeb0840e7cadaf58dd0dcd64b9fd9a7c00eeae76092c0eeca25dbd1fe2058241
MD5 94d0f6cd005598f63dcef9952d995c2b
SHA1 fc04a11492c85108c028bc81b7c0cbc94b1a2fb8
SHA512 e48aaed0c3884cbdadf9f0774d13b462ef238cd6b54a2d6d1178013ca236bb5463c7c47f2a6d91ce0b1d43366ce1831a89d3575eba77852df22440ccc66da55f
TLSH
T1FA61F9190E05549DEFD31631E9D123B83AB4B3978A8FBE56421CC8BD6A35F3246CA00C
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 1KB
SHA256 2eb7df9c1b62abb8914678e820378181b53a1ac08757031661176b626163cada
MD5 213c221aa82380129706b11262d1b941
SHA1 e2d9b5464bd5fa5e9a4f9fff70c115e78b92aaf0
SHA512 5ace75a323a5b47883c40cb317292961038142ae37b5c9478ccc5668442580f0c39e204487ed1383dd5ebc848e452b3d93cabbd973d9f231b22343153e8b2f4d
TLSH
T1B7219EF383E186AE890156F09A24AE1BDE1D0516821C7C2589E4BF2793F3075D00265F
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 6ea5446278f4c0d0fd4cb46d4e857f7d1a4d9dd270843b8027c8124462657601
MD5 6927633a2f0ef166a1681263a1de2631
SHA1 a7ee2459d6a6319e57aac8b967be870afb7d8594
SHA512 a0ae12a37c32553d581a414b559f653c54e9c6ad21fa9060817640ae7f5a2c419eb675b755c948d0c726f568eeebc122f989be8c8ecd1cf83b532afc1216c81d
SSDEEP 192:sxZJRsyM/jK1Ml8Mkt/fssQfgLaAIdpdmHW6+WNGYHjXBFJFZIgrJ:sxZJmMt/fssQYLqAHbGyFl9
TLSH
T12442E811AA38A977CCDFD209FA457F53D6F90472A2900E44A9FCDA1C04E6BED221781F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 ce93a517ec0b8305c8c9e2f9e6d6f4b6a1e2a726f190e1ca01830270dc70b567
MD5 0818db7bb486183fc5cf873c8bd412a4
SHA1 925c145228ec705cb5d8cd642a1fe5b640280136
SHA512 3345b2701e20c6b4a37678e7b5eaadc99d3a7e4d0a4ec901120aafd02363e54686c7d357e55731bc67cacb1d757d1fa1d5c8dee00b532b191b810c6528b55422
SSDEEP 192:sxZJRsyM/jK1Ml8UQBkt/fssxfgOaAIdpHmHW6+WNGYHFN0mdFJFZIg5ZJ:sxZJmqSt/fssxYOqGHbGELFlF
TLSH
T19952E815AA38A977CCDBD21DFA45BF53D6F9047292900E44A9FCCA1C04E6BED220781F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 30KB
SHA256 99b906c97f3eb5707ab7a9e0c9c99581331d07ba224fed2cb6fc2ecda61160e1
MD5 2d2645be7ca0c718af7b248da65e8347
SHA1 6be38053439238ec5477156db5f53ef646b7ab80
SHA512 b03bb2ab3b6a7a26f7be7078c3a7768cdc34eddb4303feef76933f1d9196b5ac80948b1cab5bfa0db0e72b0424116976de11b3c34db09d7ee1eb5e2becd0cf75
SSDEEP 768:R4UZYTMWvg0Po8F1+UoAYDCx9Tuqh0VfUC9xbog/OVOeLlPZ4RKroVk0Q+:R4UZYTMWvg0Pou1ja7eLZmRhVf
TLSH
T111D20B2B680CCB7E4F844E9DEC266F863ED801CB5A584D5447EA894C03CB7EF512B59B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 6KB
SHA256 b9564b39b823bc3933a130f0b1a6305cff3cd290976c0312761593036c7585d9
MD5 572a43811ce1d8ed6cec7ce065fb2483
SHA1 7410f4ac1aba4d61430d5e6865de2447984e399e
SHA512 291a3070c456255d200ea97c86eff3e6c4b6acf30365b9768a61ec01d0e6af4b985aeb6fba074202e28b0abb80408760f18b067e217191345e0b305562e0297c
SSDEEP 96:KA1eK2AUqIKLSqKAIKheqWkKzC2W7KKU0M:ES3D2rZF
TLSH
T18DD1130272BB02033C3D6918A2AA97774F45F1E33454E82B7BA854B64D66E741CFD8ED
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

d497c6c2-98b4-43d6-8153-97ab3e8d9c73.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\d497c6c2-98b4-43d6-8153-97ab3e8d9c73.tmp
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 14KB
SHA256 dc4b270a53bb665dace9b0ea63d34c87efd7ce08de64f230b4ed52fe64a6ae1f
MD5 6dea67deb0cdcaac21ddaf70ffa68f4d
SHA1 3ffbc8ab46ae506324fc08354381f0785ad388f6
SHA512 4b37c2f31dbf575f71afd93d3e0d9bb53e366f3fc0de2d28c1e1367195f0d1776592db8c90bf0bb50e7ae64536f4b84519adf7c5272eb6573d09dcd3c5afe786
SSDEEP 384:GsNZfOeQjckduzX5od+2OU9Qysa+VYsd7U8:GuTkgOTOUayhg35
TLSH
T1E5624C36A9686C774DE7A6D5F54B32139FB850A7DA882FD482DC5F1C01DE29C230781A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 17KB
SHA256 f7d5ec4eaaf2bf8d4d445c5976d52804213876757d426dd8e3295e6eb61b196d
MD5 3e70f8da94218d2d9b1b080605888e6d
SHA1 a4d22c41c64b4079406dc7d08427f65c4aded770
SHA512 36425b0d62ead2375550aa029c03a3a34b96601e9309c4afc6ad1c33a52327641cb561d6557197a078871b53629cf9ac4c013f59b13d3e1a430c7461f434c4a4
SSDEEP 384:uiFmsNE8TUNTUlIlyOeQjckduzX5od+2OU9Bysa+VYsd7U8:FFmDwgATkgOTOUDyhg35
TLSH
T1FA822A3399949C7B9EE6AB85F64B32139FF450A7DA84AAD4D3C85E1C01DB2DC130BC16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 76376ec541a080e7fd1b40d36bbcde26f4a951fa6be14460cc70e6e29b677e00
MD5 5d29bbb6444f4454d656cfe8f2947a74
SHA1 f7cccf979376c637bcf82cc7a4b1fdbccc7a7541
SHA512 91ff1bba838d7abf34137da4e8a5a2a4a2db9637b71a2d8a1a8d81aba3024c8c3a59dd8cf4fff405be4372e43451d2871ed4d54b6059d95fde50ab3fbc297b50
SSDEEP 192:yON061VWQmiUyHCgGX5Obd+jKOImm/ag3GFU6:yON06WDgGX5od+2OTlFU6
TLSH
T14302D735A9687C678EF2BE49F58737135FA8206BEA546F84D6E81B1C00D769C2306827
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 5a606c964bf8cc8cbe31b8b840afad75d7a200a358680c19e119d4263ff37f36
MD5 7f23ff49cd19d8909d90c9dd5d6658ea
SHA1 7c08b31977ff4e2b3ed9bdf25598b435da0a8068
SHA512 7d33660a75c27d3de4137faa6e58316892390c7cf50097c7356b0d7df6673eefef892b5bac5a21fc9c0fd84ae732105835698c81f3e1191cf4d7758874f29046
SSDEEP 192:fONIh61mWQmiUydC/GX5Obd+jKOImy9fjJ0q4U6:fONs67n/GX5od+2OU99yU6
TLSH
T1DE12F936A968BC775EE2B585F48732135FA95167EA447FC0C1DC2B2C01DB6AC230BC56
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 17KB
SHA256 71bbb1ccef81985502ac3541cbac3741fcfa963545cbbc4dd43dd4803d6a814b
MD5 c792515a3f536dd3a2a02e2f6fa527cb
SHA1 03a8f3c8385b5ecb9c2d9d612edb0b580defc5e7
SHA512 77e5a8c2a89a421e79d5bbccba9890f134f1f162479caa94a3682dc46ac18ccf4cf03c41672ccceff37ae287f09888759f38550845601f0308e37029a060a405
SSDEEP 384:uiFmsN78TUNTUlIlyOeQjckduzX5od+2OU9gysa+VYsd7U8:FFmCwgATkgOTOU+yhg35
TLSH
T1B0721A339994AC7B9EE6AB85F64B32139FB450A7DA84AAD4D3CC5E1C01DB2DC1307C16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 14KB
SHA256 e035f7c959f23f3c37394932cc44d37772a17e433096de85b0ec0eded99bcdb9
MD5 c1c7fcec6eb65c73f3451b05c1e16775
SHA1 f831896d7ab5ac756415f949401f3d194fa977c6
SHA512 4643aea797c6d118f45d672eac4e9d118e53a828db78bc3cf6e75ee98a5ce8fcf5e2441e089dda31fd677b5aeb5721f5c5a8e16f495c09b040e45a68fd8a029e
SSDEEP 384:DsNZyOeQjckduzX5od+2OU9Qysa+VYsd7U8:DjTkgOTOUayhg35
TLSH
T16E624C36A9686C774DE7B6D5F64B32139FB850A7DA882FD482DC5F1C01DE29C230781A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

007249f1-7e96-4218-b7fa-473713b78a6d.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\007249f1-7e96-4218-b7fa-473713b78a6d.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 6500695097ec921dbecfdb80c6940b4c8da61c9989e1a2579acaf4a827619ffb
MD5 d86f20b872ed2b01839997994501f268
SHA1 8a340eca120757534a490a2b854c9e5d0a853f3d
SHA512 b03086fd4eb2dee378929024c0c5c232ffbe913e0f050846fb43bb223b22250ba59d1f8e52334294e36d72745e5c5ee0b3475a3095b05a9c1f054dbad26db8a6
TLSH
T1F4412A58B7FA1144B3B77F5AAFF6686E487B79732E0AD46E10110E4F0622A00C8B1737
MD5 SHA1 SHA512 TLSH

Submit Download