d6a2953452c4b0d9c6853367cde550b275d4af549abf4cd07db57ec9d22d683c

Analysis

max time kernel
148s
max time network
145s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260618-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260618-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
22/06/2026, 01:15

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
readme.html
Size 7KB
Sample260622-bl765ag17s
SHA256 d6a2953452c4b0d9c6853367cde550b275d4af549abf4cd07db57ec9d22d683c
MD5 161dba8de49f41eee63421cce887ca0e
SHA1 b1fa0fbc7ac9176f2af1d8e1eade2215e0589884
SHA512 2de5c438949e6b349d0450ccf95a904521482593b776b3b7a39478a04500f8c752103a75db353d884723d6556b639858c5482047f81e4bd57c277ae3e3ad76d3
SSDEEP 96:CQUK8pz1E/4kF5kyJ0ifN8uueKQMdc8FdFPKuID9kKCZxjD+9+25tdLwGg1IZz67:n8/SVPmuB3C/Da7d0JuCidI
TLSH
T157E1A56BB540537A135143B1600621BA733300BEB79D464654DBE62EBBA23B4AF7F0DE
MD5 SHA1 SHA512 SSDEEP TLSH

Score

4^/10

discovery

Malware Config

Signatures

Drops file in Windows directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SystemTemp	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4652	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134265645448257595"	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-537605601-1362463912-856654178-1000\{3BE447B5-7904-4E7A-ADB1-B6989F48D196}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2256	msedge.exe
2256	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
5392	msedge.exe
5392	msedge.exe
5392	msedge.exe
5392	msedge.exe
5392	msedge.exe

Suspicious use of FindShellTrayWindow 33 IoCs

pid	Process
5392	msedge.exe
5392	msedge.exe
5392	msedge.exe
5392	msedge.exe
5392	msedge.exe
5392	msedge.exe
5392	msedge.exe
5392	msedge.exe
5392	msedge.exe
5392	msedge.exe
5392	msedge.exe
5392	msedge.exe
5392	msedge.exe
5392	msedge.exe
5392	msedge.exe
5392	msedge.exe
5392	msedge.exe
5392	msedge.exe
5392	msedge.exe
5392	msedge.exe
5392	msedge.exe
5392	msedge.exe
5392	msedge.exe
5392	msedge.exe
5392	msedge.exe
5392	msedge.exe
5392	msedge.exe
5392	msedge.exe
5392	msedge.exe
5392	msedge.exe
5392	msedge.exe
5392	msedge.exe
5392	msedge.exe

Suspicious use of SendNotifyMessage 16 IoCs

pid	Process
5392	msedge.exe
5392	msedge.exe
5392	msedge.exe
5392	msedge.exe
5392	msedge.exe
5392	msedge.exe
5392	msedge.exe
5392	msedge.exe
5392	msedge.exe
5392	msedge.exe
5392	msedge.exe
5392	msedge.exe
5392	msedge.exe
5392	msedge.exe
5392	msedge.exe
5392	msedge.exe

Suspicious use of WriteProcessMemory 30 IoCs

description	pid	Process	procid_target
PID 5392 wrote to memory of 2336	5392	msedge.exe	88
PID 5392 wrote to memory of 5184	5392	msedge.exe	89
PID 5392 wrote to memory of 4652	5392	msedge.exe	90
PID 5392 wrote to memory of 5184	5392	msedge.exe	89
PID 5392 wrote to memory of 5184	5392	msedge.exe	89
PID 5392 wrote to memory of 5164	5392	msedge.exe	91
PID 5392 wrote to memory of 5164	5392	msedge.exe	91
PID 5392 wrote to memory of 4572	5392	msedge.exe	92
PID 5392 wrote to memory of 5760	5392	msedge.exe	93
PID 5392 wrote to memory of 4572	5392	msedge.exe	92
PID 5392 wrote to memory of 4572	5392	msedge.exe	92
PID 5392 wrote to memory of 5760	5392	msedge.exe	93
PID 5392 wrote to memory of 5760	5392	msedge.exe	93
PID 5392 wrote to memory of 4872	5392	msedge.exe	95
PID 5392 wrote to memory of 1536	5392	msedge.exe	96
PID 5392 wrote to memory of 4872	5392	msedge.exe	95
PID 5392 wrote to memory of 4872	5392	msedge.exe	95
PID 5392 wrote to memory of 1536	5392	msedge.exe	96
PID 5392 wrote to memory of 1536	5392	msedge.exe	96
PID 5392 wrote to memory of 1596	5392	msedge.exe	98
PID 5392 wrote to memory of 2084	5392	msedge.exe	99
PID 5392 wrote to memory of 1596	5392	msedge.exe	98
PID 5392 wrote to memory of 2084	5392	msedge.exe	99
PID 5392 wrote to memory of 5160	5392	msedge.exe	101
PID 5392 wrote to memory of 6084	5392	msedge.exe	105
PID 5392 wrote to memory of 2116	5392	msedge.exe	106
PID 5392 wrote to memory of 1752	5392	msedge.exe	107
PID 5392 wrote to memory of 5872	5392	msedge.exe	108
PID 5392 wrote to memory of 5872	5392	msedge.exe	108
PID 5392 wrote to memory of 2256	5392	msedge.exe	110

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument C:\Users\Admin\AppData\Local\Temp\readme.html
1⤵
- Drops file in Windows directory
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:5392
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x260,0x264,0x268,0x25c,0x2c0,0x7ffa70bfc188,0x7ffa70bfc194,0x7ffa70bfc1a0
  2⤵
  PID:2336
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1680,i,10723076669130417949,1124462591372770117,262144 --field-trial-handle=2380,i,7276190554427632874,4930571646381063618,262144 --variations-seed-version --mojo-platform-channel-handle=2372 /prefetch:2
  2⤵
  PID:5184
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1876,i,7607441904129694916,10155236229882757274,524288 --field-trial-handle=2380,i,7276190554427632874,4930571646381063618,262144 --variations-seed-version --mojo-platform-channel-handle=2980 /prefetch:11
  2⤵
  - System Time Discovery
  PID:4652
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2396,i,8202459704202272301,11713754848172886971,524288 --field-trial-handle=2380,i,7276190554427632874,4930571646381063618,262144 --variations-seed-version --mojo-platform-channel-handle=3240 /prefetch:13
  2⤵
  PID:5164
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3592,i,15254917910620764092,3031515606564182239,2097152 --field-trial-handle=2380,i,7276190554427632874,4930571646381063618,262144 --variations-seed-version --mojo-platform-channel-handle=3604 /prefetch:1
  2⤵
  PID:4572
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3596,i,18242199589773111919,7522618332816697626,2097152 --field-trial-handle=2380,i,7276190554427632874,4930571646381063618,262144 --variations-seed-version --mojo-platform-channel-handle=3628 /prefetch:1
  2⤵
  PID:5760
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4296,i,122333028753418124,7888659111115803534,2097152 --field-trial-handle=2380,i,7276190554427632874,4930571646381063618,262144 --variations-seed-version --mojo-platform-channel-handle=3572 /prefetch:9
  2⤵
  PID:4872
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4280,i,7994669260838644702,18096966129438245508,2097152 --field-trial-handle=2380,i,7276190554427632874,4930571646381063618,262144 --variations-seed-version --mojo-platform-channel-handle=4452 /prefetch:1
  2⤵
  PID:1536
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5296,i,6333404537463188897,7884339229375521769,524288 --field-trial-handle=2380,i,7276190554427632874,4930571646381063618,262144 --variations-seed-version --mojo-platform-channel-handle=5420 /prefetch:14
  2⤵
  PID:1596
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5372,i,1572140843628669234,6198510860970105571,524288 --field-trial-handle=2380,i,7276190554427632874,4930571646381063618,262144 --variations-seed-version --mojo-platform-channel-handle=5440 /prefetch:14
  2⤵
  PID:2084
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6076,i,15095103696066007146,13623486226311996723,524288 --field-trial-handle=2380,i,7276190554427632874,4930571646381063618,262144 --variations-seed-version --mojo-platform-channel-handle=6096 /prefetch:14
  2⤵
  PID:4676
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6076,i,15095103696066007146,13623486226311996723,524288 --field-trial-handle=2380,i,7276190554427632874,4930571646381063618,262144 --variations-seed-version --mojo-platform-channel-handle=6096 /prefetch:14
  2⤵
  PID:5160
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4292,i,14853541846457001888,15244270810350729907,524288 --field-trial-handle=2380,i,7276190554427632874,4930571646381063618,262144 --variations-seed-version --mojo-platform-channel-handle=6076 /prefetch:14
  2⤵
  PID:6084
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3764,i,11800271994374654781,9807596973879047481,524288 --field-trial-handle=2380,i,7276190554427632874,4930571646381063618,262144 --variations-seed-version --mojo-platform-channel-handle=4896 /prefetch:14
  2⤵
  PID:2116
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3768,i,6135691376953143186,5404911284576654467,524288 --field-trial-handle=2380,i,7276190554427632874,4930571646381063618,262144 --variations-seed-version --mojo-platform-channel-handle=4904 /prefetch:14
  2⤵
  PID:1752
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5424,i,6339571994643840694,16347727091012726139,524288 --field-trial-handle=2380,i,7276190554427632874,4930571646381063618,262144 --variations-seed-version --mojo-platform-channel-handle=5488 /prefetch:14
  2⤵
  PID:5872
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=2788,i,9661252151381035554,3811270733595070680,262144 --field-trial-handle=2380,i,7276190554427632874,4930571646381063618,262144 --variations-seed-version --mojo-platform-channel-handle=6212 /prefetch:10
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2256

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:4176

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:5560

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 ff19e848916f9346514f95113e3d80cd569935b36d785719b19d90f9f740fbd6
MD5 5ab41182d14eb22e7143c63d2e18b77b
SHA1 ca8c747e1a5e38b0f0a08b492fcea6d3a75865c2
SHA512 bbecb67f89826ee2bd219f14bbc8ca87fb260f8a22bd2d52b6ccdb72d47a4b58eeb897a42a6e591bd4e75fe870419162172353d5d3ec7f1fb0fbc7b5dc6adcf1
TLSH
T1AED080757B467B11D58F0472D424E271A737455135D296057170C10E55602D1FFCA0B7
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 5f46172781024fe58b7a7d87a406b81679d17de445e9e90110d33f5747ecc226
MD5 08a5ef0e8eb4590a7f0e6f821698071e
SHA1 1b756aceae48cf2649d310d7ab4883595c2e5bde
SHA512 95c72989df00c3caf1230ca41b6dcbc24f8a592c45202f7b16044b8d574fe569d4db8614652b0d1695d3fe1d795b07ea334de5b4fa9dcbb9d27de40a55592586
TLSH
T155D080757B467A11D58F0476D424E271A737455125D296057170C10E55602D1FFC90A7
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 30522e315645364d4b4f7c4be83b7e6921e0c1cee7fec4e1fb6b55faa4137f39
MD5 4a653bcd5ae56290395a16689d057317
SHA1 8d4398655a365493531b5f6408138d9f151185da
SHA512 4b2f7fcb57cd1e4cbcaddb2a9c396e13dd25a5d0970b63714fe8730d402da5254bffeb956a2ba657cb460fc94104fd06f5c8c76abd58fa1b5c10eee1081ab7fb
TLSH
T1D1616E38B04A8914EBF8453498C1B896BFF41A6C753B6F213C8DB3747B0730876EA258
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe593eb5.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe593eb5.TMP
Size 3KB
SHA256 6fa56b84870c66713adc56bd62038fb4a44c8b93da4ff5928baaacf2a619b8b6
MD5 19ac542cd7f816a427b5634db76809d9
SHA1 c2909ea1cbf0b50e711275779f0e3ffc59646a97
SHA512 e3fdbf7572bda0f831c500ef83ca337755042dc8f9da166e9da15f01269350d22884803d73b016828c3554f0feb04c35f546cd366088a55c9873ba7663d4fd8c
TLSH
T1BB616F38B54A8914EBF4453498C1B896BFF41A6C753B6F213C8DB3747B0730876DA258
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 1KB
SHA256 8f44789c2f6c45bf394f524d37fd1739261cb8384cd5afddd1581af48b756cb1
MD5 f181f61e0faa6a659eb593a2a118939f
SHA1 b772826a61ca01c881eb6938f2f7a090dd71b24e
SHA512 52de0a7a59dfd94213ae89a3ad3f30f54dc342efd1b5a980e75d3f85f9995123e7046b5ac6946793fb7295eb805c3abca02d8be3fe4099a78ad4bcf12e2a1713
TLSH
T15A41AAF3C3E4866D890146F0BA147E2BCE2D0915836C3D5AC9E4AF1BA3F2871E14194F
MD5 SHA1 SHA512 TLSH

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

fc23d285-9fad-474f-a32b-e149ad7a97d6.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\fc23d285-9fad-474f-a32b-e149ad7a97d6.tmp
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 96f86d3a7c124f09b525f74a9e48517026d0ebb850edd086641451dbe892d888
MD5 7fc2f098d8c5ed0d8bbeffe3f22fea34
SHA1 1263efaea4b5ef0f012a085753f737dc0274a258
SHA512 816695aae904775f9df96a6f35512e21afd439642adfada787fe3729ba476f9122ce647e99522001bb35e9e9960664baee7b6d56b267b5bd8150679609a1ae74
SSDEEP 192:sxR3RKyM/jK1Ml8wF7/fNsV8zMdybyzoA8p4//g6+WNIY4pj4GIIgIJ:sxR38b7/fNsV8I4C/5Iqs
TLSH
T1E552D9165A38997BCCDBD209FA517F53D6F81573B2901E44AAFC860C04E7AED221782F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 fe444a3cb735a3c0a74faedc06445b0daffdc0fa8360c0a4271b27c839dd8c5d
MD5 12c3ba24e9d6bbfa5ab2d4d7a3368a9e
SHA1 7f98a4091068c82c8ce85df54bf6705875ee05b9
SHA512 723c7e598d3544ec9f020a4b833027ee83164d8e8b3fa38f7409c824947f313ddbc9dbe6cf3a01d1b3b6d03180708da3e32940d9f7c1171189ad8fff5154dcaf
SSDEEP 192:sxRERKyM/jK1Ml8wF7/fNsj8zMdybyzoA8p4//g6+WNIY4pj4GIIgDUJ:sxRE8b7/fNsj8I4C/5Iq0
TLSH
T1B652D9165638997BCCDBD209FA517F53D6F81573B2901E44AAFC8A0C04E7AED221782F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 3094887fb90e4503114e608774a02fbac80811bbdc580a37e274268354c68341
MD5 d353cfc4a27f2bd6ebc0b055cea5a974
SHA1 4d3c86bc48f8fdf5f59347b1910b433ef768ae29
SHA512 beeb8d22b556cf7c9e6b2c58dfa9fd4ec829f60ae5ac6adf5f3c657f88ee45b678a48a613e95834587aed59422cb3b4b99c72cfaf51e580d6be6d6a75d776276
SSDEEP 192:sxRERKyM/jK1Ml8UQwF7/fNsjezMdybyzoA8pe//g6+WNIY4pM4GIIgDGJ:sxRE8qm7/fNsjeI4Y/5ITO
TLSH
T18F62B7165638997BCCDBE209F6517F53D6F81573A2901E44AAFCCA0C04E6ADD221782F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 27KB
SHA256 f1642f0d9bb3be4bb6fe3ca8002af3aea507d8649b590fd12186381c63982e76
MD5 a955b60f37f1fc1ca877cf052614b3a9
SHA1 dadb534b1b6084f24123bdabd77d52a2befce488
SHA512 52f5d139bf98d60c996747089793f5b94fb8b40cbda4fecedbc517ea38a0a7d5384ba91ed61264528ab723950f34100781bee1a49f6071c2a1f350b1e508a0df
SSDEEP 768:NmymipWgvHfSv8F1+UoAYDCx9Tuqh0VfUC9xbog/OV1LxgproRLPR2DQ:NmymipWgvHfSvu1ja8NgCRLPUc
TLSH
T17CC2FB3B640CC77E4F844EADEC29AE976DD801CB9B588D5447EA890C03C67FB911A4DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 52aad6e1d5ceab8af32a76c349f1788dc8b8b8d40303d1235d9f59539474272d
MD5 de2aedb922cc3531afd7fff4e44006c8
SHA1 442e20f2d23a49aebc5d4b651d43b009e20ac86a
SHA512 b46a8f144d87d2c6294990d7238bcd98a91d3cbd2d5ae102b8ba045dafac1641c443655efdf25a906f988cdf7fe8b0e5222aecb537ef061c356172f751ab2582
SSDEEP 48:KMiIfKrqofycmVKWUwB1KZ1DjTixLgRICliKPHHfi7Fyk4n1LyBARq+IOKjx6TSu:KMiEKrqy8O0KPqC+RSKCgk
TLSH
T18691601075BB230039BE7908A190B59F564234B3303AA52B7BF925E52E27E006FFD9DD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

839e51a1-a3b0-4a86-9e65-a41ca8e91aea.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\839e51a1-a3b0-4a86-9e65-a41ca8e91aea.tmp
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 36KB
SHA256 c70384f96eafad945a37bd510827f6c5ef9496a0fd459fcf022190e4c9d1242f
MD5 d85a6ad830941da8f4bc18a0bff8fd7d
SHA1 6929116e061be68188388742ec9ae822ccad566f
SHA512 d50258a97c046de692df0ddbd76cffeea2a968b96c12a05f77a4f430eae85ca98be15d38f33517cb24a52b15a6682d9860882575296b0caf7bedaec19c36b63a
SSDEEP 768:Uj+9W32cxfywfIJqfFoA7NpespIRM0UmkTziwjgzSOQxuv0:D9W32af7fsqfPQsZ0UmYuFv0
TLSH
T141F2AE3194609E678DF6EA897A023B0B6EF0035392C42E4498DDAF0D89C76AC574BD1F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 39KB
SHA256 c695295e8bc2611bd64e5af25b4014c185fe09037a986d1d04c8e425a8d19108
MD5 b20b8e5817376410c72a668e53b0e4a2
SHA1 5af9ecf6147e2909f3f199212eaadd2416ab84b7
SHA512 c684daa083ad44d7c5b69320f5c24e97345bac77005b32423032fcf81081ae8b7d4d6491b2a12a3fe987dcf23654b3e2a80cab2bd37495c5d9aa7f951d321cf1
SSDEEP 768:qjaeqD4MlshiLdMmA33XxfywfIJqfFuA7NpespIRM0UmkTziwjgzSO8TM:qqcjhIdMP33Bf7fsqfNQsZ0UmYuT
TLSH
T16B03BF7298605DB78DB7EA8A6A0336576EF00253C2C53E88DCDD6E0D45976EC530B81B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 36KB
SHA256 5564d04a295bfcc79e0345c4e22b4b50cea659b1757241f703a85b8cf9024c57
MD5 24b4569bc89bd39a5d3a891b2f9c7364
SHA1 3b8cba34eeb94555a366a3f79a3aa50968341e59
SHA512 3f8a6749f43fb2c91df48e63d983d29872a39becd313b9efe9c52f9bf23487111922c0f5033fd78806802aae44d84eeadd24fb9a6104633dc7e58037fbf2dff7
SSDEEP 768:Rj+9W33cxfywfIJqfFoA7NpespIRM0UmkTziwjgzSOQxuv0:M9W33af7fsqfPQsZ0UmYuFv0
TLSH
T1B4F2AE3194609E678DF6DA897A063B0B6EF0035392C42E4498DDAF0D89C76AC574BD1F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 40KB
SHA256 0b2afbe84ca991c1fce3102e2c9b0f9271e22e83ecb75445d5239a657f3384c3
MD5 0a76ebdd23d92fab17e679f3213da5c6
SHA1 f394d7104c7c7f96747b48a938ccd1a68231d790
SHA512 ccecbf79a64eb1150dec2abf97062e530b66b82a7b921d8183328e4a2e0c8f8aa5d86828aa3e731c61781018ea49390f1a5eae8d4ed4b33e13c5dadc984b4f70
SSDEEP 768:3jaeqD4MlshiLdMmf37MfywfIJGA7NpespIRM0UmkTziwjgzGZnApXLPQTU:3qcjhIdMo3Qf7fsPQsZ0UmYxnKXD
TLSH
T1F303BF7698204EB78CB7E68A264376576FB00253C2C43AC8CCED5E0D42975DD630B96B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 39KB
SHA256 bff72c62a7d7e062afb812539a10a88ed0d54eac17820a9bfb49144bd66bb1b2
MD5 f112cace423ecd76a0e52bf3a6e1739c
SHA1 3d35ae45314b308f7e962fd0c028e860b8b5b58a
SHA512 90ed62753e764358019fd21f84b8aeada908b720ee0d814c62241d5d9938e58b26aa28eb0ec91ba4f846327ab07ae8fcd187db0bd1015c453d8c3fd6583b8b2b
SSDEEP 768:CF1j+9h38wgdcxfywfIJqfFVA7NpespIRM0UmkTziwjgzSOQxuv0:39h3gaf7fsqfCQsZ0UmYuFv0
TLSH
T11703AE3288509E6B8DFADB89BA063707AEF00363C1846E44D9DDAE0D45C76EC134BD1A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\metadata.json
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download