4c13d452dd5d49671bd93ca32f2b4f85c78e39b6ab0ad1f38d98ed267f8fd896

Analysis

max time kernel
148s
max time network
150s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260618-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260618-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
21/06/2026, 12:11

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
fknew/1sysadmin/media/items/Dsc-29-03-2026-1774776936সাইকেল.webp.html
Size 1KB
Sample260621-pc26eac17l
SHA256 4c13d452dd5d49671bd93ca32f2b4f85c78e39b6ab0ad1f38d98ed267f8fd896
MD5 8150f458ed6fb9b1db4e5cfa57a1a281
SHA1 6e5726854d28687b560d7fdcb5c782c425c7dfb9
SHA512 4cc6a112673aef8bb8bb8a385c26791b805d43bb707b509880e894f1c83bab4e16f13de187036c5f660c3bec1d286258396b7bde65c5d7945c5019665196818c
TLSH
T1C021353EC1C1560AE0271164FBC1F7A86669825291970F703B9EB176F6CD0BB56A36C8
MD5 SHA1 SHA512 TLSH

Score

4^/10

discovery

Malware Config

Signatures

Drops file in Windows directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SystemTemp	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
5888	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134265175566590322"	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-537605601-1362463912-856654178-1000\{AFFEB2B3-34B9-4972-A549-3364B742F333}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
5656	msedge.exe
5656	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
4840	msedge.exe
4840	msedge.exe
4840	msedge.exe
4840	msedge.exe
4840	msedge.exe

Suspicious use of FindShellTrayWindow 33 IoCs

pid	Process
4840	msedge.exe
4840	msedge.exe
4840	msedge.exe
4840	msedge.exe
4840	msedge.exe
4840	msedge.exe
4840	msedge.exe
4840	msedge.exe
4840	msedge.exe
4840	msedge.exe
4840	msedge.exe
4840	msedge.exe
4840	msedge.exe
4840	msedge.exe
4840	msedge.exe
4840	msedge.exe
4840	msedge.exe
4840	msedge.exe
4840	msedge.exe
4840	msedge.exe
4840	msedge.exe
4840	msedge.exe
4840	msedge.exe
4840	msedge.exe
4840	msedge.exe
4840	msedge.exe
4840	msedge.exe
4840	msedge.exe
4840	msedge.exe
4840	msedge.exe
4840	msedge.exe
4840	msedge.exe
4840	msedge.exe

Suspicious use of SendNotifyMessage 16 IoCs

pid	Process
4840	msedge.exe
4840	msedge.exe
4840	msedge.exe
4840	msedge.exe
4840	msedge.exe
4840	msedge.exe
4840	msedge.exe
4840	msedge.exe
4840	msedge.exe
4840	msedge.exe
4840	msedge.exe
4840	msedge.exe
4840	msedge.exe
4840	msedge.exe
4840	msedge.exe
4840	msedge.exe

Suspicious use of WriteProcessMemory 30 IoCs

description	pid	Process	procid_target
PID 4840 wrote to memory of 5772	4840	msedge.exe	88
PID 4840 wrote to memory of 5692	4840	msedge.exe	90
PID 4840 wrote to memory of 5888	4840	msedge.exe	91
PID 4840 wrote to memory of 5692	4840	msedge.exe	90
PID 4840 wrote to memory of 5692	4840	msedge.exe	90
PID 4840 wrote to memory of 3824	4840	msedge.exe	92
PID 4840 wrote to memory of 3824	4840	msedge.exe	92
PID 4840 wrote to memory of 2876	4840	msedge.exe	93
PID 4840 wrote to memory of 4292	4840	msedge.exe	94
PID 4840 wrote to memory of 2876	4840	msedge.exe	93
PID 4840 wrote to memory of 2876	4840	msedge.exe	93
PID 4840 wrote to memory of 4292	4840	msedge.exe	94
PID 4840 wrote to memory of 4292	4840	msedge.exe	94
PID 4840 wrote to memory of 3564	4840	msedge.exe	95
PID 4840 wrote to memory of 1428	4840	msedge.exe	96
PID 4840 wrote to memory of 3564	4840	msedge.exe	95
PID 4840 wrote to memory of 3564	4840	msedge.exe	95
PID 4840 wrote to memory of 1428	4840	msedge.exe	96
PID 4840 wrote to memory of 1428	4840	msedge.exe	96
PID 4840 wrote to memory of 2796	4840	msedge.exe	98
PID 4840 wrote to memory of 3580	4840	msedge.exe	99
PID 4840 wrote to memory of 2796	4840	msedge.exe	98
PID 4840 wrote to memory of 3580	4840	msedge.exe	99
PID 4840 wrote to memory of 5656	4840	msedge.exe	101
PID 4840 wrote to memory of 468	4840	msedge.exe	105
PID 4840 wrote to memory of 4404	4840	msedge.exe	106
PID 4840 wrote to memory of 564	4840	msedge.exe	107
PID 4840 wrote to memory of 956	4840	msedge.exe	108
PID 4840 wrote to memory of 956	4840	msedge.exe	108
PID 4840 wrote to memory of 5656	4840	msedge.exe	110

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument C:\Users\Admin\AppData\Local\Temp\fknew\1sysadmin\media\items\Dsc-29-03-2026-1774776936সাইকেল.webp.html
1⤵
- Drops file in Windows directory
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4840
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x260,0x264,0x268,0x25c,0x288,0x7fffe682c188,0x7fffe682c194,0x7fffe682c1a0
  2⤵
  PID:5772
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1892,i,11688923148950763072,13350165794001170335,262144 --field-trial-handle=3008,i,17672178066964543237,548409103390353191,262144 --variations-seed-version --mojo-platform-channel-handle=3000 /prefetch:2
  2⤵
  PID:5692
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2152,i,17949350499302062857,9626183836972056123,524288 --field-trial-handle=3008,i,17672178066964543237,548409103390353191,262144 --variations-seed-version --mojo-platform-channel-handle=3088 /prefetch:11
  2⤵
  - System Time Discovery
  PID:5888
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2404,i,5413147158290869294,4935041165621011149,524288 --field-trial-handle=3008,i,17672178066964543237,548409103390353191,262144 --variations-seed-version --mojo-platform-channel-handle=3244 /prefetch:13
  2⤵
  PID:3824
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3532,i,12818433120970588475,16257403029207901680,2097152 --field-trial-handle=3008,i,17672178066964543237,548409103390353191,262144 --variations-seed-version --mojo-platform-channel-handle=3592 /prefetch:1
  2⤵
  PID:2876
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3536,i,2740866118575686245,11027678830005347396,2097152 --field-trial-handle=3008,i,17672178066964543237,548409103390353191,262144 --variations-seed-version --mojo-platform-channel-handle=3612 /prefetch:1
  2⤵
  PID:4292
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4176,i,534949711099445538,6750579380694212580,2097152 --field-trial-handle=3008,i,17672178066964543237,548409103390353191,262144 --variations-seed-version --mojo-platform-channel-handle=4724 /prefetch:9
  2⤵
  PID:3564
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4164,i,14371625898393645105,13052472079032983008,2097152 --field-trial-handle=3008,i,17672178066964543237,548409103390353191,262144 --variations-seed-version --mojo-platform-channel-handle=4720 /prefetch:1
  2⤵
  PID:1428
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5216,i,11870504123620361610,10241945993442581270,524288 --field-trial-handle=3008,i,17672178066964543237,548409103390353191,262144 --variations-seed-version --mojo-platform-channel-handle=5272 /prefetch:14
  2⤵
  PID:2796
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5248,i,5621757626838347254,6324199851543880914,524288 --field-trial-handle=3008,i,17672178066964543237,548409103390353191,262144 --variations-seed-version --mojo-platform-channel-handle=5320 /prefetch:14
  2⤵
  PID:3580
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5836,i,11765669403163843788,5613558118353534535,524288 --field-trial-handle=3008,i,17672178066964543237,548409103390353191,262144 --variations-seed-version --mojo-platform-channel-handle=5864 /prefetch:14
  2⤵
  PID:1260
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5836,i,11765669403163843788,5613558118353534535,524288 --field-trial-handle=3008,i,17672178066964543237,548409103390353191,262144 --variations-seed-version --mojo-platform-channel-handle=5864 /prefetch:14
  2⤵
  PID:5656
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4936,i,18058490916651868718,15921964915225046066,524288 --field-trial-handle=3008,i,17672178066964543237,548409103390353191,262144 --variations-seed-version --mojo-platform-channel-handle=3592 /prefetch:14
  2⤵
  PID:468
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3680,i,4845949612245258334,868685176450990394,524288 --field-trial-handle=3008,i,17672178066964543237,548409103390353191,262144 --variations-seed-version --mojo-platform-channel-handle=1232 /prefetch:14
  2⤵
  PID:4404
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4176,i,1763748014307362275,10159605355405125881,524288 --field-trial-handle=3008,i,17672178066964543237,548409103390353191,262144 --variations-seed-version --mojo-platform-channel-handle=6528 /prefetch:14
  2⤵
  PID:564
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5292,i,10728190145239940684,10140203781555214113,524288 --field-trial-handle=3008,i,17672178066964543237,548409103390353191,262144 --variations-seed-version --mojo-platform-channel-handle=5280 /prefetch:14
  2⤵
  PID:956
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1436,i,9238881135079299797,3963164353600125212,262144 --field-trial-handle=3008,i,17672178066964543237,548409103390353191,262144 --variations-seed-version --mojo-platform-channel-handle=5528 /prefetch:10
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5656

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:1424

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:5908

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 ff19e848916f9346514f95113e3d80cd569935b36d785719b19d90f9f740fbd6
MD5 5ab41182d14eb22e7143c63d2e18b77b
SHA1 ca8c747e1a5e38b0f0a08b492fcea6d3a75865c2
SHA512 bbecb67f89826ee2bd219f14bbc8ca87fb260f8a22bd2d52b6ccdb72d47a4b58eeb897a42a6e591bd4e75fe870419162172353d5d3ec7f1fb0fbc7b5dc6adcf1
TLSH
T1AED080757B467B11D58F0472D424E271A737455135D296057170C10E55602D1FFCA0B7
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 5f46172781024fe58b7a7d87a406b81679d17de445e9e90110d33f5747ecc226
MD5 08a5ef0e8eb4590a7f0e6f821698071e
SHA1 1b756aceae48cf2649d310d7ab4883595c2e5bde
SHA512 95c72989df00c3caf1230ca41b6dcbc24f8a592c45202f7b16044b8d574fe569d4db8614652b0d1695d3fe1d795b07ea334de5b4fa9dcbb9d27de40a55592586
TLSH
T155D080757B467A11D58F0476D424E271A737455125D296057170C10E55602D1FFC90A7
MD5 SHA1 SHA512 TLSH

Submit Download

26820b48-39bf-4cb4-a38f-84e57fd83e0a.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\26820b48-39bf-4cb4-a38f-84e57fd83e0a.tmp
Size 14KB
SHA256 c56b2632adab95169a4de237aba08ecef644cb29a155180a70060e3cac4d4c1c
MD5 d1d62ea92b79d474e627717b12bad034
SHA1 f1cd4f3c590641d84087b4ddbc1fe4ad8e76ca36
SHA512 37161cadc47de3e9372e36333eca61ada3cac47f0a9754afeb8d05a69f6c0f2e070c385834a75aea47ecc20a10bb4157f0cf1bec08fae1bffe6988ecbb6a66c0
SSDEEP 192:sxRd6RcyM/jK1Ml8wFh/ffsE3RzMdybdzoA8p4Vs/g6+WNIY4pjsGTIgIJ:sxRd6mbh/ffsEhIvD/5Ips
TLSH
T1BC52C9169638997B8CDBD20DFA51BF53D6F91573A2901E44AAFCD60C00E7AED221381F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

767722f3-e72f-4bbe-8a80-f840ddc298be.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\767722f3-e72f-4bbe-8a80-f840ddc298be.tmp
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 869cc0ba0310ac0e678743a1ffc83e7e440e7bb6b94a7cf947038f3a1739b854
MD5 a823fd950c298a9fa9993f59cb70da97
SHA1 06a9c3743339e73ae97553a6a0a8e86830117ff1
SHA512 bc0227fef0c9c5a78c8443e3580713a290da9e32346a71bd8482a84068097ff70ab2159c1f5be1e16a18fd6e274a83cea6495d0cccb3f6eeb13427acce255d11
TLSH
T18D615E513062B9A5DBE4C57B60F11099BFFC1A5EB5CB2E9E83507EB8EFC63045082464
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe590e5e.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe590e5e.TMP
Size 3KB
SHA256 624ef760a0cdddfd9458c5dfee35b7f8b0bd78c6d7be339bcc1d5a0f2125ddd0
MD5 36dc3081006a7b8e31a78176d128ccba
SHA1 13e96474b48c1bced5349a75f3e80528ab395e9b
SHA512 8ac002d6437041863e3049eb2bfaf1b1e49257661f3e319c0dec9130547f75938edc97fc1fd9ceaf4111faaf8606a0f1eeab443b8f8134c7010299bef588835a
TLSH
T1AA615E513062B9A5DBE8C57B60F11099BFFC1B9EB5CB2E9E83507E78EFC63045082464
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

HubApps

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\HubApps
Size 106KB
SHA256 eb2fd7422436fff93f6be09df3294b26cdb7afd18e6aa94dcdc0f208db78b2ed
MD5 25dca813dd764f2197142ef84bc5ce66
SHA1 8d6aefb01ee9f6d1fb0cfd89326cfe35af53a53d
SHA512 a9c8cd547c874b7b69cbb3a0c8214f43837911e522db768dcd075d23d05acfd7122cf2bcad281ea745025e4fb67cc9061b79f9dc1288ac1a113bd0d961841d43
SSDEEP 1536:IfEEtnH74ohBGZqW3iPPDuVvpBI/SvtZsA62UYPq:BuHSRhPjU1
TLSH
T154B35226D6A54C6B01F16264EC794382F325436F9282A82F3B7C5D5C2FBD93A6502F7C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 1KB
SHA256 ef7d2a8dc33503b651262f47ca20b4bfb71bceed32a83059b794c2c2c7992355
MD5 92cb299565221360d4aa64ffac05de7d
SHA1 5529c07b84564b73ec7423bd3f1cd8076d35f2a3
SHA512 98e0f9a732b3bdccb869cdf097eccffc609768c2ee9a97ebc31f4acc2ab1bee5752a1b9c6e9aa728504e467dca98a9fd26d43fbd6a2db6fedd23942c208b5770
TLSH
T1C73199F3C2E8867E890156F4BB146E2BCE2D0914836C3D5AC9E4AF5B93F2871E14195F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 6b21d54a4dc1b72e9cba6787dfc6a93b54314544824dfad85761a0cabf4c3bbe
MD5 34a0da66a0fb1a80c78c9e829846da0a
SHA1 4e735bfa501e385cc0f18632489842fa2f440475
SHA512 801f2b30edcdef993d81328503cd29f77a93126b6515dbc69760c25b329d7535fbcf1d86fc83c1a46188c4a642346c5d8b1f30ab98a794c492eb517bcf26a451
SSDEEP 192:sxRdBRcyM/jK1Ml8wFh/ffsC3RzMdybdzoA8p4Vs/g6+WNIY4pjsGTIgD9J:sxRdBmbh/ffsChIvD/5Ip7
TLSH
T1AF52C916A634997B8CDBD20DFA51BF53D6F91573A2901E44AAFCD60C00E7AED221381F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 0eafc065abbfaba6749ff8df5cdd653d5a1a918b1efcbf25ba80ca63e483ab01
MD5 b5a985b06f928567706c23b1cffb4f0d
SHA1 6d9b546a068af398f304a3887d00b7b16c317f47
SHA512 91ab803d0b8635759f62e170d1a51d8c313ee3f7ac7b42323f5af2f146bbb137ad17b7282e607b85b4d827252aaf2ab7968f497d1054c28f30df84de1d4428d4
SSDEEP 192:sxRdBRcyM/jK1Ml8UQcFh/ffsC3uzMdybdzoA8peVs/g6+WNIY4pPsGTIgDTJ:sxRdBmqqh/ffsC+Iv5/5IJp
TLSH
T1D462C8169634997B8CDBE20DF651BF53D6F85573A2901E44AAFCDA0C00E7ADD221382F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 27KB
SHA256 a21e1a6cb1d645850dad8b000facd7a03ee7b66ac62d132e73d3cc2558818877
MD5 7d958f50699a4101e48b899fcf6242ae
SHA1 4d49e27d33758e80657e409347e9d9bf79b9f3f9
SHA512 2ef85686b710cf7f9c9ead10d02e82590dca4fdd0504a41dbae67adbb2969efc80883758846a126d6418f0f2d13a8d50547ea7450f9f49fea4617752de8d382a
SSDEEP 768:NmymipWgvHfSv8F1+UoAYDCx9Tuqh0VfUC9xbog/OV1LxgmroRLPG2Ds:NmymipWgvHfSvu1ja8NgdRLPpo
TLSH
T12BC2FB3B640CC77E4F845EADEC29AE976DD801CB9B588D5447EA880C03C67FB911A4DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 167e71970e7940c24bca550b62b39711812254c5dd6b0825ed51660733405400
MD5 abb8855ac22407aaa04737beaf0f23f8
SHA1 6c1ef71987c003de45b09c61461122ccc0bf27e8
SHA512 8c4f832a90062f910834b0835caa03415131550282811d0440d56464d8976ba58e8d663738c13531eb955df8a5ff3e7a3ec3cc5f3d8c9200872d53db54bb7a55
SSDEEP 96:KYDaKg4CiSkKTiKcZu6ce+RbaLMxCRKpYx8R9EsTC+yKz:kZvSJS
TLSH
T13591F206F57B321438BD39088560856B6A8230B7719BE82B7F7855F59E37E009EFD8C9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

cbc73416-d8e2-4278-98f5-6a6753dbe4d8.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\cbc73416-d8e2-4278-98f5-6a6753dbe4d8.tmp
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 36KB
SHA256 aa73ddb3af46136011427e5128782169b994c2d81a662bdbdd4fc5d986db5175
MD5 bfe91705b7aca8fff27255c3ed2b26ed
SHA1 ef623b1f3612f6c31932afe399f6b1ffe566d24a
SHA512 c105ffa3c9d04981fc8acd4ae44c000d54f26c85c4defd7eafb3a1b51f020b98c75885a2cb97783687f00ee089a394b3d956f66904b6bea790d51e26b716a3ba
SSDEEP 768:sj+9u3ZdfyEffyyff4tqLA7NpespIRM0UmkTziwjgzSK5ARR3vp:r9u3/fjf5fZeQsZ0UmYq5AL3vp
TLSH
T1E1F2AE3294209DA74DE6A78D75033B47AEF0022395C53F8889DDAF0D41C7AAC570BE6A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 36KB
SHA256 cda0295878b459d25b30bfa2ba157d59f125550de7d636a16aa1faf16360d319
MD5 fee87b052a1c89b51928301b1c8fbdbb
SHA1 7fd5b5a38b430bd156c4eb26ba6bf889c2516832
SHA512 a9fb01bfe4074c781a73de4f8b6f75edcbce7e7d36315c1d7e128b707bf1f72c79fd4e0f8f250b6eff4bd6e0fc032327c98ed4958e15c5938f36887445c4f1d3
SSDEEP 768:3j+9u35dfyEffyyff4tmA7NpespIRM0UmkTziwjgzSK5ARR3vp:69u3ffjf5f4QsZ0UmYq5AL3vp
TLSH
T193F2AE3294209DA74DE6E78D75023747AEF0022395C53F8899EDAF0D41C7AAC570BE6A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 39KB
SHA256 dc5b8eb7001b75887cb99ec8b5eddc996ea332f6464f63c7b65876b33bbfc6f2
MD5 9378823ddd5536dc90098afaaa30293a
SHA1 2e7643515393cd967b9c587e878da565d7e8a24c
SHA512 2be7af31bd76b85c515b33ac4583313981d9665a09c5e0094ef04291277156cb3fbb7dd759821509d97fa2c1429200b44dae896601fa2f413a419cdb8295b2bc
SSDEEP 768:nF1j+9A34wgMdfyEffyyff4tvA7NpespIRM0UmkTziwjgzSK5ARR3vp:O9A3lfjf5fRQsZ0UmYq5AL3vp
TLSH
T10803AE339860CDBB4DF69B8CBA063747AEF00163D4C57A889ADDAE0C41876DC174BD66
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 40KB
SHA256 be467f31d32055f62c322d57c0c1face9e513609723b959559d545b5fced29eb
MD5 b4bb6bc5dadde07c885b5207d591873c
SHA1 7e6920a6fa191299e782832738cc52a63db78555
SHA512 7c0c5af487e6d3f303572d916466503c757cf487714fec3e8541ea8b846fa7d3047b047c9996629a9336968a42d7240aa3cb75e0b72609e2323103d5a054c591
SSDEEP 768:3jaeqD4MlshiLdMmf3spfyEffyuA7NpespIRM0UmkTziwjgzG6nApXLPQTU:3qcjhIdMo3yfjfeQsZ0UmYSnKXD
TLSH
T1F603CF3698605EB78CB6E68A264776576FB00293C2C43FC8CCDE6E0D42876DD530786B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

3c06ef14-d764-41a7-8e27-c258a931d531.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\3c06ef14-d764-41a7-8e27-c258a931d531.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download