4924b2b154e0366e0c3526cd0fc2b9eeca4aa706eb1e5e1e90630ea783c7fe14

Analysis

max time kernel
148s
max time network
140s
platform
windows11-21h2_x64
resource
win11-20260911-en
resource tags

arch:x64arch:x86image:win11-20260911-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
30/09/2026, 15:07

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
sample.html
Size 302KB
Sample260930-shkebsvx2n
SHA256 4924b2b154e0366e0c3526cd0fc2b9eeca4aa706eb1e5e1e90630ea783c7fe14
MD5 202c8641c692cc8d7cb24da1874d3bde
SHA1 2ea8415acc70c7dbd8d541f8ac06a21c6b5b6f46
SHA512 ffcce2f0e35aa7284f1ee6548c2e0ffa0c2c88e984ccbc763fa98c3ecfe153e4ac32ce8624b99949c981a2b6981fb20db5ba15d3c9834bf9da8539cb3184d794
SSDEEP 3072:u0G8HuzqGQ3QIALjlYitFg3Prb3FCboIYrXvJ8575KJZvXq:/G8HuzqPAIALeitFsjaoIIG0JZva
TLSH
T104646C326300B43BB813DD91A6BF6F4E3C25E127DC0A46F8A9A1E530DFE2EB2151565D
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4572	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2322150968-3922673059-3248713381-1000\{32BBC245-D820-40BD-B46E-E422B4BAEAEF}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
6128	msedge.exe
6128	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
4780	msedge.exe
4780	msedge.exe
4780	msedge.exe
4780	msedge.exe
4780	msedge.exe
4780	msedge.exe
4780	msedge.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
4780	msedge.exe
4780	msedge.exe
4780	msedge.exe
4780	msedge.exe
4780	msedge.exe
4780	msedge.exe
4780	msedge.exe
4780	msedge.exe
4780	msedge.exe
4780	msedge.exe
4780	msedge.exe
4780	msedge.exe
4780	msedge.exe
4780	msedge.exe
4780	msedge.exe
4780	msedge.exe
4780	msedge.exe
4780	msedge.exe
4780	msedge.exe
4780	msedge.exe
4780	msedge.exe
4780	msedge.exe
4780	msedge.exe
4780	msedge.exe
4780	msedge.exe
4780	msedge.exe
4780	msedge.exe
4780	msedge.exe
4780	msedge.exe
4780	msedge.exe
4780	msedge.exe
4780	msedge.exe
4780	msedge.exe
4780	msedge.exe

Suspicious use of SendNotifyMessage 16 IoCs

pid	Process
4780	msedge.exe
4780	msedge.exe
4780	msedge.exe
4780	msedge.exe
4780	msedge.exe
4780	msedge.exe
4780	msedge.exe
4780	msedge.exe
4780	msedge.exe
4780	msedge.exe
4780	msedge.exe
4780	msedge.exe
4780	msedge.exe
4780	msedge.exe
4780	msedge.exe
4780	msedge.exe

Suspicious use of WriteProcessMemory 38 IoCs

description	pid	Process	procid_target
PID 4780 wrote to memory of 2224	4780	msedge.exe	82
PID 4780 wrote to memory of 4572	4780	msedge.exe	84
PID 4780 wrote to memory of 1404	4780	msedge.exe	86
PID 4780 wrote to memory of 1404	4780	msedge.exe	86
PID 4780 wrote to memory of 916	4780	msedge.exe	85
PID 4780 wrote to memory of 916	4780	msedge.exe	85
PID 4780 wrote to memory of 916	4780	msedge.exe	85
PID 4780 wrote to memory of 3964	4780	msedge.exe	88
PID 4780 wrote to memory of 4924	4780	msedge.exe	89
PID 4780 wrote to memory of 3964	4780	msedge.exe	88
PID 4780 wrote to memory of 3964	4780	msedge.exe	88
PID 4780 wrote to memory of 4924	4780	msedge.exe	89
PID 4780 wrote to memory of 4924	4780	msedge.exe	89
PID 4780 wrote to memory of 3336	4780	msedge.exe	90
PID 4780 wrote to memory of 4416	4780	msedge.exe	91
PID 4780 wrote to memory of 4528	4780	msedge.exe	92
PID 4780 wrote to memory of 4840	4780	msedge.exe	93
PID 4780 wrote to memory of 3336	4780	msedge.exe	90
PID 4780 wrote to memory of 3336	4780	msedge.exe	90
PID 4780 wrote to memory of 4416	4780	msedge.exe	91
PID 4780 wrote to memory of 4416	4780	msedge.exe	91
PID 4780 wrote to memory of 4528	4780	msedge.exe	92
PID 4780 wrote to memory of 4528	4780	msedge.exe	92
PID 4780 wrote to memory of 4840	4780	msedge.exe	93
PID 4780 wrote to memory of 4840	4780	msedge.exe	93
PID 4780 wrote to memory of 892	4780	msedge.exe	96
PID 4780 wrote to memory of 4820	4780	msedge.exe	97
PID 4780 wrote to memory of 892	4780	msedge.exe	96
PID 4780 wrote to memory of 4820	4780	msedge.exe	97
PID 4780 wrote to memory of 5108	4780	msedge.exe	99
PID 4780 wrote to memory of 6044	4780	msedge.exe	100
PID 6044 wrote to memory of 5372	6044	msedge.exe	101
PID 4780 wrote to memory of 5228	4780	msedge.exe	102
PID 4780 wrote to memory of 5200	4780	msedge.exe	103
PID 4780 wrote to memory of 1296	4780	msedge.exe	104
PID 4780 wrote to memory of 5004	4780	msedge.exe	105
PID 4780 wrote to memory of 5004	4780	msedge.exe	105
PID 4780 wrote to memory of 6128	4780	msedge.exe	107

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument C:\Users\Admin\AppData\Local\Temp\sample.html
1⤵
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4780
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x23c,0x240,0x244,0x21c,0x258,0x7fffce32c188,0x7fffce32c194,0x7fffce32c1a0
  2⤵
  PID:2224
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --subproc-heap-profiling --always-read-main-dll --metrics-shmem-handle=1852,i,17214772363017425405,14292579758091827768,524288 --field-trial-handle=2112,i,3666416044976097137,4988948949517309989,262144 --variations-seed-version --mojo-platform-channel-handle=2176 /prefetch:11
  2⤵
  - System Time Discovery
  PID:4572
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --subproc-heap-profiling --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1652,i,3697115068921645775,8780663680765304727,262144 --field-trial-handle=2112,i,3666416044976097137,4988948949517309989,262144 --variations-seed-version --mojo-platform-channel-handle=2108 /prefetch:2
  2⤵
  PID:916
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --subproc-heap-profiling --always-read-main-dll --metrics-shmem-handle=2368,i,13575352791976775192,456452665629248792,524288 --field-trial-handle=2112,i,3666416044976097137,4988948949517309989,262144 --variations-seed-version --mojo-platform-channel-handle=1988 /prefetch:13
  2⤵
  PID:1404
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --subproc-heap-profiling --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3492,i,16523418975159135733,18138147532399509318,2097152 --field-trial-handle=2112,i,3666416044976097137,4988948949517309989,262144 --variations-seed-version --mojo-platform-channel-handle=3532 /prefetch:1
  2⤵
  PID:3964
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --subproc-heap-profiling --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3512,i,10658121471978298673,3128160284606331484,2097152 --field-trial-handle=2112,i,3666416044976097137,4988948949517309989,262144 --variations-seed-version --mojo-platform-channel-handle=3556 /prefetch:1
  2⤵
  PID:4924
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --subproc-heap-profiling --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4236,i,16803122804840216642,13249643581174613510,2097152 --field-trial-handle=2112,i,3666416044976097137,4988948949517309989,262144 --variations-seed-version --mojo-platform-channel-handle=4300 /prefetch:1
  2⤵
  PID:3336
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --subproc-heap-profiling --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=4264,i,11290679199469433923,7718223739990482861,2097152 --field-trial-handle=2112,i,3666416044976097137,4988948949517309989,262144 --variations-seed-version --mojo-platform-channel-handle=4336 /prefetch:1
  2⤵
  PID:4416
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4248,i,15483774755429479526,9004671252997470101,2097152 --field-trial-handle=2112,i,3666416044976097137,4988948949517309989,262144 --variations-seed-version --mojo-platform-channel-handle=4324 /prefetch:9
  2⤵
  PID:4528
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --always-read-main-dll --metrics-shmem-handle=4276,i,14507285836936428563,1156785309705474323,2097152 --field-trial-handle=2112,i,3666416044976097137,4988948949517309989,262144 --variations-seed-version --mojo-platform-channel-handle=4348 /prefetch:9
  2⤵
  PID:4840
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --subproc-heap-profiling --always-read-main-dll --metrics-shmem-handle=4592,i,6342590608245430315,11075309803256724806,524288 --field-trial-handle=2112,i,3666416044976097137,4988948949517309989,262144 --variations-seed-version --mojo-platform-channel-handle=3656 /prefetch:14
  2⤵
  PID:892
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --subproc-heap-profiling --always-read-main-dll --metrics-shmem-handle=5368,i,1516000504275589935,2174798290935492129,524288 --field-trial-handle=2112,i,3666416044976097137,4988948949517309989,262144 --variations-seed-version --mojo-platform-channel-handle=3676 /prefetch:14
  2⤵
  PID:4820
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --subproc-heap-profiling --always-read-main-dll --metrics-shmem-handle=6036,i,15809460948177605540,7483438670708607740,524288 --field-trial-handle=2112,i,3666416044976097137,4988948949517309989,262144 --variations-seed-version --mojo-platform-channel-handle=6076 /prefetch:14
  2⤵
  PID:6112
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --subproc-heap-profiling --always-read-main-dll --metrics-shmem-handle=6036,i,15809460948177605540,7483438670708607740,524288 --field-trial-handle=2112,i,3666416044976097137,4988948949517309989,262144 --variations-seed-version --mojo-platform-channel-handle=6076 /prefetch:14
  2⤵
  PID:5108
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.ProfileImport --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --subproc-heap-profiling --always-read-main-dll --metrics-shmem-handle=6216,i,1479993152239443901,13639089294065012264,524288 --field-trial-handle=2112,i,3666416044976097137,4988948949517309989,262144 --variations-seed-version --mojo-platform-channel-handle=6224 /prefetch:14
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:6044
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\cookie_exporter.exe
    cookie_exporter.exe --cookie-json=1100
    3⤵
    PID:5372
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --subproc-heap-profiling --always-read-main-dll --metrics-shmem-handle=6036,i,966847525377090240,11910536098239344267,524288 --field-trial-handle=2112,i,3666416044976097137,4988948949517309989,262144 --variations-seed-version --mojo-platform-channel-handle=4632 /prefetch:14
  2⤵
  PID:5228
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --subproc-heap-profiling --always-read-main-dll --metrics-shmem-handle=4412,i,2925122868923716858,10266657773528714098,524288 --field-trial-handle=2112,i,3666416044976097137,4988948949517309989,262144 --variations-seed-version --mojo-platform-channel-handle=6188 /prefetch:14
  2⤵
  PID:5200
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --subproc-heap-profiling --always-read-main-dll --metrics-shmem-handle=4348,i,17227499163225545357,13636160032876858294,524288 --field-trial-handle=2112,i,3666416044976097137,4988948949517309989,262144 --variations-seed-version --mojo-platform-channel-handle=6732 /prefetch:14
  2⤵
  PID:1296
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --subproc-heap-profiling --always-read-main-dll --metrics-shmem-handle=5616,i,2253856838905809289,2136351429588159405,524288 --field-trial-handle=2112,i,3666416044976097137,4988948949517309989,262144 --variations-seed-version --mojo-platform-channel-handle=4968 /prefetch:14
  2⤵
  PID:5004
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --force-high-res-timeticks=disabled --subproc-heap-profiling --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6320,i,6901629743885366161,12443396393555272190,262144 --field-trial-handle=2112,i,3666416044976097137,4988948949517309989,262144 --variations-seed-version --mojo-platform-channel-handle=6384 /prefetch:10
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:6128

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:3508

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 0714e6f61cb4ee87df081093ea45647348bd6b088c2ac1e6188d495c78e99d7e
MD5 2fe08827a42341294e10b9edd0b51268
SHA1 9825b24ae78e2cde9480297e7e4013d6c0959b16
SHA512 7a0465cafbdfbb547a5cef98322581d1e80a528dd4189337fb6b5b13ed414e2f42b21bf71aa7a23f7a751b405de9800d7ecb96c64b25f954ebb7a1f0780507ac
TLSH
T19CD0112AFA222E02E000E232802ABA82020080828C8208088A800222A8C2802882B22A
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 a4da83f7c2db56b3b267d8673cd329c9ebe11518ed1355fee48e02e2eb7dc667
MD5 da5bf6bf079a2d0b72f1ba828bb869c4
SHA1 c5b477ca5fa0737bc5ec1d3971d7c5864a969233
SHA512 4bb0cdef8b5998fe4d7dca2c5da777f9d5541df6ec2a269e22d862e25cb11ad1dd6794d959246e60431138d67653ebeed6d6a8ad98885459f62f51a91e4f6048
TLSH
T17CD0222EFB232E02F800E332803CFB830200C0C3CC830A088E800222E8C38028C2B32F
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 baf3cecf86e022e58842d1f61fc4978c13549e6f9d4ef1e6db8ee98bab189787
MD5 69b5d32502c8d90f6d3b0d164232a084
SHA1 1699e584e95d1276c2d8e103977de1b2d4921c4b
SHA512 ce01c3aae7285f5f2bf596b2430ff5212d3dad1ac05ead12ddfdaef43be0a0813b91579a1e48a62d42659947e3238f08b00f91957befd1c67dbc138f5f9e7c0e
TLSH
T11A514C815F7A87B2E7BD45B389F1158B37395694B4A35F4322A0F8B94F36F8491C0247
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 ce1e98575ad31c20b730c8b7cadb0200edccf2eee6dd896a24705c0f0c6c9317
MD5 f5c1f57e993ebebdd6607aacd0c6c9fa
SHA1 f0e8c433f3723d5849970578f38bd1fbc168d631
SHA512 4146ce1e36c903bcc0843a92e2365bedd08ce5f47be58d6e126d416aa73f149d3c45c42a111aa01b630bca28f6de0bf640d2870bd3052d9edfafbd295983c6e8
TLSH
T18241CEB7C3D4867E891556F09B28AE2ACE2D051A422C3C56C9E8EF9F63E2471D10129F
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

e60dcb8a-59bc-4234-913d-8967f89668c8.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\e60dcb8a-59bc-4234-913d-8967f89668c8.tmp
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 9KB
SHA256 300734b01adef1f0ea522377e25f9eaae2d511ee8a69a27d1111d76f0d710f60
MD5 1a9b6ce354ec87fe0b2443bddeee08ce
SHA1 8df4294e5c8a304b6a780d9be9d03d2bd9fef7d7
SHA512 a3e25ae3569215dbee778a2648dfb229850011ade3edbc03fea89577f1963406da229a72febf78e593434112e6392de211e9a0f9c2890bae38e4fa33a04cfb8a
SSDEEP 192:sxZqRTbw/fosiAyO1Idpya/W6+WNGY0CoVQ+XIgrJ:sxZqBw/fos7yTN/bG5RQw9
TLSH
T1DB22B7116E34A97B8CCBE219BB29BF53E6F9143291D11E88E6FC851C04E76DE120784F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 10KB
SHA256 f71e23e1591c31e290268cabaf0cf72e493217a453036168a8e63366a574113f
MD5 07fb0f3d8ab76f37c27e2905c5ee52b5
SHA1 a6dc25f8606f72df7e522aea29189ec07041db29
SHA512 e42ece5b1bad7fdfd103d94475f5bbb6e2b5128966596494674aef0bfe7608c2b3b80ea3f324198662b8bfc01ff063d24460027651ea1d16c5704e317a5cbc90
SSDEEP 192:sxZqRTbw/fosgAyO1Idpya/W6+WNGY0CiVQ+XIg5gJ:sxZqBw/fosdyTN/bG5VQwW
TLSH
T12222C7116E34A97B8CCBD21ABB25BF53E6F9103291D11E88E6FC861C05E76DE121784F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 10KB
SHA256 d7abc721a6a7233a1d35e8b21a744173e1261177acee7e0060c91110543e7767
MD5 f3506268e1353b72eccdf090383a4b88
SHA1 316c2d5bb3d7e9c45fa0a239633bd20a7f3185c7
SHA512 7535a9aa07dce046241873db810424d8cb70af5b8d0077f2989af85f033905228a35888c6b93a79ab7b73a94cd007710fb01ad3a31f97e69e915856b3afeeaf1
SSDEEP 192:sxZqRTbw/fos5AyO1Idpya/W6+WNGY0CeVQ+XIg5SJ:sxZqBw/fosuyTN/bG5LQwU
TLSH
T1E022C8116E34697B8CCBE219BB25BF53E2F9503291911E88A6FC861C05F76DE120784F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 10KB
SHA256 5f98cf43a7d58581b8cd98be81b6e70c13b2269d62e8b06f6868a2748cd0876a
MD5 f178a6f943bced8311c0725693ce4258
SHA1 09315e6327d3fb522c57687e0a88314943f3fd1f
SHA512 9a4abd585b8ce07edb7cc5def5dd682a2f3dcae4df0562b743d70aa8f4e4fc41cddfcc811981ffe8fbb2636842379fcc41c9dea6befcb380adbe4cb7548b9e30
SSDEEP 192:sxZqRTbw/fos5AyO1IdpEa/W6+WNGY0C+VQ+XIg5SJ:sxZqBw/fosuyTb/bG5bQwU
TLSH
T12722C9516E34697B8CCBE21DBB25BF53E2F9503291911E88A6FC861C05F76DE120784F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 28KB
SHA256 3fad80e42dd5d330267776ebd9a50a26d58d4541468f534186b93373a11b7a65
MD5 dc27f7b9619c8d3499877a16e743ed91
SHA1 21ec2d7ef670b093146aa78d51d0f8970b7e0caf
SHA512 cbfe788be3145ee684ed4e78aef37d041e8d4fe0f5efd92056e4c2d5a03fd200aaffbf106bee32d26e86ee688a4019168eba1ae139116e5d64c67dc680d3ae0a
SSDEEP 768:8YlTj8Gr2ymWRm+KQEC8F1+UoAYDCx9Tuqh0VfUC9xbog/OV3MxLl/C80f07roRv:8YlTj8Gr2ymWRm+KQECu1jaKMxLpCNf1
TLSH
T1CFD20B3F240CCB7E4FC01A9DDD566F976E9802C7A6688D4047FE984C02D77EA912A4CB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 6a024d508639c9c47a51f4821302e62d0b94c65ad6ddd61f34e33619db8473b1
MD5 c5898e940f06382088a60913dd003e99
SHA1 0677d253c38eea3c05fac4c8149be18cac12b67c
SHA512 b1b1ca2623ceb0e315042e3313ebfe15e6f0f3808bdccf7b400c4f18671411d7d56360a1bd617e0879f2d949696cae0002567d8dcebcea1d86d3d6e2ebd3cef1
SSDEEP 48:KABI1KaQAfyxaI/KraQpwjCOo+SLbC16IiWLKRy5MLlwbUGnR9yL7z7m7n7T7h7P:KABWKaQCCasKrawbGKMQm6q
TLSH
T197A1DA52327A4281387D391880ACDB6F126235B7715CEE6B7FB881A24E27F144DFC9D9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f081ac1f-ac3c-474e-b414-f55febf1e1ae.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\f081ac1f-ac3c-474e-b414-f55febf1e1ae.tmp
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 ef63e595308cb639acaba974af904bb586a8157b0c57593101f3cba718c13f23
MD5 07dfeb1f4d310dc2c259ea846010ded4
SHA1 66e68f442b5c627c7108f913194a92540a80995f
SHA512 b3003a215e733260e342478feef01b540b55c0bc654c849ecd6883da65bfce7264e7c239047e175829be8fb613ef7096bdeb29f4e06246541e4a34d4b9a269cb
SSDEEP 384:RZcI68NmUnDRIy63qsK5SP9+3iYYo0NVZh6DKhHlo8:56kU9SPsNfYGHlD
TLSH
T172828D325C786C7A4CF6E946F4473A178E78805BD7882EC8D4ED6B2D05EB6941307D26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 e6503be5ff497e3948f273795ee79343e651151e1dbb980af8e1c30a28b4d5ac
MD5 88c9de1b52a0015bcff1e508ccb1a012
SHA1 c61d3e02419a0a6473157625d401ad95f25d48ef
SHA512 69301ffcb18fba1f9f455018748b2f6b281d95fd4f8d2d47a01bff603b9dcff88c8d7588d44edf78a14af8401497f614beee17120af17dd26f1f02bee724fbc0
SSDEEP 384:nZcI68NmU6DRIy63qsK5SP9+3iYYo0NVZh6DKhHlo8:P61U9SPsNfYGHlD
TLSH
T196828D325C786C7A4CF7E946F4473A178EB4805BA7882FC8D4EC6B2D05EB6941707D26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 21KB
SHA256 2d6fc4fa9c1ef2ac26859e900d5b8b2c2139e00a2331a5b94f8adc98d72d9e54
MD5 18e84613c0403ce7a2d9e3ce0d9285af
SHA1 6678dfd5c480fb030b2c6f7145d1f0446aebc226
SHA512 bc06947c5914517f338d1844e2fbc6ea3a7cd8716bb281a3086e348578a3183069931765346af99150329539bed8cd6f72313cbdc34ff96a7eb39b8388558484
SSDEEP 384:eiFQZcIS8Nr8TUNTUlIl6DRIy63qsK5SP9+3iYYoYNVZh6DKhHlo8:1FuSKwgqU9SPQNfYGHlD
TLSH
T15AA27D334CA89C7F9DF6DE86F44A36178EB44067D688AAD4E2DC6A1D01EB1980307D66
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 b3286dbe671d678a2e35ab6590fbfa99b85ed2205c12ee43b312a527d31e5208
MD5 b02f1cc7e2b3096407067b5568abf3ba
SHA1 e196cab230cf02417c4b2e8fdc6c0365dafd15e2
SHA512 40c53762a4cab35ee7d73a83a00961c098c16202159334dce2a97b2abc3a7ce00fe6f989d7c1aa7f7687e2881ac68d579158736780751717e1ca259f7f42fa9f
SSDEEP 192:9GNo6UbxQmiUy9Jpg+W9XPaP9+pr5/+U6:9GNo6IPSJm+kSP9+rmU6
TLSH
T13402E8356C787C7B8EF3AE15B48B36275FA9102BDA952F84D9E81B2C05D764C1307832
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 123bc1b7fe38988aba20f0b7b113f326afcfe4c9185e500d16c25998bb8dd324
MD5 a36b3ef23440a299434fb95625958936
SHA1 60cc4d8c684f90b582eeacb82985cb3afbed8b17
SHA512 35ac6084af689dfedeb010c0a600ca667bdd68a3d8bb12154d9e23a7cd4de1eff5d4b61766e16d830f734ec7c1397562a7a8ce8e4c8a5bb2873f5c00a7156799
SSDEEP 192:9GNU6Ub7QmiUy7gsWW9XPaP9+3iCbPwoIPKmq2eU6:9GNU6ItxsWkSP9+3iYYobNU6
TLSH
T10B1209356868BC7F4DE39962B48735179E64412BDB892F94D5EC2B2C05EF69C030B822
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 469b1942e0f8d1244f236fe5b380701036603f0101be5c40e4537f2e88958be9
MD5 b84c0a9f6c1582a4bd52d644d4953ad8
SHA1 a6b438342f4b2328d467b283e989cf59d056cc5c
SHA512 358de041d8d6f5e147d6cec6029045e68d8ca590e130c05bd8278915f479b9f241e0d8b01dc86b4e19ac5493988579d571da84f35b6b8f588bcedee1bdab6c77
SSDEEP 384:JZcI68NmU7DRIy63qsK5SP9+3iYYo0NVZh6DKhHlo8:B6kU9SPsNfYGHlD
TLSH
T13F828D325C786C7A4CF6E946F44B3A178E78805BE7882FC8D4ED6B2D05EB6941307D26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

2f2d6621-eccc-4780-ba80-8c9a215d2809.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\2f2d6621-eccc-4780-ba80-8c9a215d2809.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download