02595856ad354a47e9c664a55dc428aad19ce73a00fe95228bbe590cfca944d8

Analysis

max time kernel
149s
max time network
127s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260618-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260618-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
22/06/2026, 12:16

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
README.html
Size 1KB
Sample260622-pfty7sby5l
SHA256 02595856ad354a47e9c664a55dc428aad19ce73a00fe95228bbe590cfca944d8
MD5 2d939d7afe37b02f77e4eb4d5e5916fc
SHA1 7aaea8ffacef9986f3c99c9a172763fc90c71217
SHA512 26df83433c38890b4e5bfe29b508666257b3abd562568c5fe7558925128c28d89d237420aa872db4710ef7d511b478e867751cb6426679a52554dc7b89ac948a
TLSH
T10021FEB3C2526B3AB563034E305BD6D42F12F28150545F5C72B640DAB8CA227B41B3DE
MD5 SHA1 SHA512 TLSH

Score

4^/10

discovery

Malware Config

Signatures

Drops file in Windows directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SystemTemp	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
2804	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134266042385629651"	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2894455325-857903158-4263030270-1000\{18A6AF7F-B4A1-49AE-AF4F-00ACCC949E1B}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3548	msedge.exe
3548	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
1420	msedge.exe
1420	msedge.exe
1420	msedge.exe
1420	msedge.exe
1420	msedge.exe

Suspicious use of FindShellTrayWindow 33 IoCs

pid	Process
1420	msedge.exe
1420	msedge.exe
1420	msedge.exe
1420	msedge.exe
1420	msedge.exe
1420	msedge.exe
1420	msedge.exe
1420	msedge.exe
1420	msedge.exe
1420	msedge.exe
1420	msedge.exe
1420	msedge.exe
1420	msedge.exe
1420	msedge.exe
1420	msedge.exe
1420	msedge.exe
1420	msedge.exe
1420	msedge.exe
1420	msedge.exe
1420	msedge.exe
1420	msedge.exe
1420	msedge.exe
1420	msedge.exe
1420	msedge.exe
1420	msedge.exe
1420	msedge.exe
1420	msedge.exe
1420	msedge.exe
1420	msedge.exe
1420	msedge.exe
1420	msedge.exe
1420	msedge.exe
1420	msedge.exe

Suspicious use of SendNotifyMessage 16 IoCs

pid	Process
1420	msedge.exe
1420	msedge.exe
1420	msedge.exe
1420	msedge.exe
1420	msedge.exe
1420	msedge.exe
1420	msedge.exe
1420	msedge.exe
1420	msedge.exe
1420	msedge.exe
1420	msedge.exe
1420	msedge.exe
1420	msedge.exe
1420	msedge.exe
1420	msedge.exe
1420	msedge.exe

Suspicious use of WriteProcessMemory 30 IoCs

description	pid	Process	procid_target
PID 1420 wrote to memory of 5196	1420	msedge.exe	88
PID 1420 wrote to memory of 2804	1420	msedge.exe	89
PID 1420 wrote to memory of 1520	1420	msedge.exe	91
PID 1420 wrote to memory of 1520	1420	msedge.exe	91
PID 1420 wrote to memory of 5844	1420	msedge.exe	90
PID 1420 wrote to memory of 5844	1420	msedge.exe	90
PID 1420 wrote to memory of 5844	1420	msedge.exe	90
PID 1420 wrote to memory of 5620	1420	msedge.exe	93
PID 1420 wrote to memory of 5620	1420	msedge.exe	93
PID 1420 wrote to memory of 5620	1420	msedge.exe	93
PID 1420 wrote to memory of 3680	1420	msedge.exe	92
PID 1420 wrote to memory of 3680	1420	msedge.exe	92
PID 1420 wrote to memory of 3680	1420	msedge.exe	92
PID 1420 wrote to memory of 5348	1420	msedge.exe	94
PID 1420 wrote to memory of 4528	1420	msedge.exe	95
PID 1420 wrote to memory of 5348	1420	msedge.exe	94
PID 1420 wrote to memory of 5348	1420	msedge.exe	94
PID 1420 wrote to memory of 4528	1420	msedge.exe	95
PID 1420 wrote to memory of 4528	1420	msedge.exe	95
PID 1420 wrote to memory of 2240	1420	msedge.exe	98
PID 1420 wrote to memory of 3428	1420	msedge.exe	99
PID 1420 wrote to memory of 2240	1420	msedge.exe	98
PID 1420 wrote to memory of 3428	1420	msedge.exe	99
PID 1420 wrote to memory of 2532	1420	msedge.exe	101
PID 1420 wrote to memory of 2448	1420	msedge.exe	105
PID 1420 wrote to memory of 1192	1420	msedge.exe	106
PID 1420 wrote to memory of 1444	1420	msedge.exe	107
PID 1420 wrote to memory of 4276	1420	msedge.exe	108
PID 1420 wrote to memory of 4276	1420	msedge.exe	108
PID 1420 wrote to memory of 3548	1420	msedge.exe	110

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument C:\Users\Admin\AppData\Local\Temp\README.html
1⤵
- Drops file in Windows directory
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1420
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x260,0x264,0x268,0x25c,0x288,0x7ffd83f1c188,0x7ffd83f1c194,0x7ffd83f1c1a0
  2⤵
  PID:5196
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1888,i,10525367379642015392,12381417138980487159,524288 --field-trial-handle=2688,i,8960158648459492993,6811720799210848988,262144 --variations-seed-version --mojo-platform-channel-handle=2716 /prefetch:11
  2⤵
  - System Time Discovery
  PID:2804
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1668,i,18057267020984216988,17655224770880901505,262144 --field-trial-handle=2688,i,8960158648459492993,6811720799210848988,262144 --variations-seed-version --mojo-platform-channel-handle=2684 /prefetch:2
  2⤵
  PID:5844
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2240,i,12924681491239929147,16722328711178580186,524288 --field-trial-handle=2688,i,8960158648459492993,6811720799210848988,262144 --variations-seed-version --mojo-platform-channel-handle=2788 /prefetch:13
  2⤵
  PID:1520
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3452,i,9362454860949209924,4375949036705259087,2097152 --field-trial-handle=2688,i,8960158648459492993,6811720799210848988,262144 --variations-seed-version --mojo-platform-channel-handle=3500 /prefetch:1
  2⤵
  PID:3680
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3460,i,13711537300222592619,11396568149663784571,2097152 --field-trial-handle=2688,i,8960158648459492993,6811720799210848988,262144 --variations-seed-version --mojo-platform-channel-handle=3508 /prefetch:1
  2⤵
  PID:5620
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4324,i,5679776552294679699,5719175084131987326,2097152 --field-trial-handle=2688,i,8960158648459492993,6811720799210848988,262144 --variations-seed-version --mojo-platform-channel-handle=4844 /prefetch:1
  2⤵
  PID:5348
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4320,i,10312563447670439414,15646238486187251713,2097152 --field-trial-handle=2688,i,8960158648459492993,6811720799210848988,262144 --variations-seed-version --mojo-platform-channel-handle=4848 /prefetch:9
  2⤵
  PID:4528
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5420,i,10522865318663427789,12107194925955144247,524288 --field-trial-handle=2688,i,8960158648459492993,6811720799210848988,262144 --variations-seed-version --mojo-platform-channel-handle=3748 /prefetch:14
  2⤵
  PID:2240
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5412,i,14241607160953148345,6668960240232965050,524288 --field-trial-handle=2688,i,8960158648459492993,6811720799210848988,262144 --variations-seed-version --mojo-platform-channel-handle=3692 /prefetch:14
  2⤵
  PID:3428
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6072,i,26428544663736531,12564999845303615705,524288 --field-trial-handle=2688,i,8960158648459492993,6811720799210848988,262144 --variations-seed-version --mojo-platform-channel-handle=6088 /prefetch:14
  2⤵
  PID:5628
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6072,i,26428544663736531,12564999845303615705,524288 --field-trial-handle=2688,i,8960158648459492993,6811720799210848988,262144 --variations-seed-version --mojo-platform-channel-handle=6088 /prefetch:14
  2⤵
  PID:2532
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4836,i,4682811696257089588,6049739348314674446,524288 --field-trial-handle=2688,i,8960158648459492993,6811720799210848988,262144 --variations-seed-version --mojo-platform-channel-handle=4784 /prefetch:14
  2⤵
  PID:2448
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4956,i,16038801799031017324,15997104442104433765,524288 --field-trial-handle=2688,i,8960158648459492993,6811720799210848988,262144 --variations-seed-version --mojo-platform-channel-handle=3752 /prefetch:14
  2⤵
  PID:1192
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4936,i,16250810257283635413,13815575015205243381,524288 --field-trial-handle=2688,i,8960158648459492993,6811720799210848988,262144 --variations-seed-version --mojo-platform-channel-handle=5168 /prefetch:14
  2⤵
  PID:1444
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3696,i,10783717541188795847,8408240970798404641,524288 --field-trial-handle=2688,i,8960158648459492993,6811720799210848988,262144 --variations-seed-version --mojo-platform-channel-handle=3712 /prefetch:14
  2⤵
  PID:4276
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=5648,i,6916264791365942760,7933795044617375041,262144 --field-trial-handle=2688,i,8960158648459492993,6811720799210848988,262144 --variations-seed-version --mojo-platform-channel-handle=6420 /prefetch:10
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3548

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:4620

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:5232

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 4921dac989a582c68ea2ce6e44eb3bfcd7f8bf3d87dd155763734d09e46d6684
MD5 6fe58dba083868c4939df3729856b544
SHA1 2946fc6a531247a5afe5d20c0abec1329e76da1f
SHA512 435b892e3c3ced9c341bcad7627e98220f381783f6c0d232345dd92e9cb28357bd93211262aa046fe541f6bd0686d5084ac7e92c687fc72829288aa7d9c823de
TLSH
T1B7D08034FB45B745C78605F2D514A720637A864534C2C60DB1A2D50D98681D0B7E79F7
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 0f06119439d622a1a5078cf90d2c84d55bc25c179cc319a31bc271a3e62dc8b5
MD5 39897ff436f6a2795449c696417893df
SHA1 b1e15f7b2c6f5ca94bea9d8a160cc9e6864c1d06
SHA512 75fae24fb44003376ccf64d6c3715357ca6f73fb6cca4422a2574a4960dc75c830ef617f5476e7fc21942b321e9fe764ebf9ae64abfc2b05a73fdd7fb96ad95e
TLSH
T1F2D08030FB45B745C78605F2D514A720637A864534C2C60DB2A2D50D98681D0B7E79E7
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 479e7144446e61e92af52f0a558d36e46fef159d957df6bc731d5d71117902d8
MD5 220cc6b7e295f7561a6a01a5e3db337b
SHA1 f76d4128cd62732b2296e712a03ecf72fd553ada
SHA512 a449619b455062aaf99e30cdc23a4573a210b1a17a1b4674061066ce5bc0d8e5dd7f9b91bdf274639bca563baf8952b5c9a5547116d0c73737912fc15f043f94
TLSH
T19C51A32112A60566EF355F789FF327BD3FB54D1239035E0D3082337ABE4E7402159165
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe591bfa.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe591bfa.TMP
Size 3KB
SHA256 8943f4b10fee095943c2663ced28b34d3bab2f01599af8c0df6c639713a74693
MD5 28426ba6183c2e99b09a91a33bb78180
SHA1 231cc28370129e422b4024d99c431653ac6cf18b
SHA512 ca036406de8106de987200714f66725468a9d892ca68813c43b5181c5ff532c39123a41ec9aa4bf9a0f1bf55b0953b5f2cb6f91ff3208d9bf379deb9d1476ed3
TLSH
T17651A32116A60565EF345F789FF327BD3FB54D5239031E0D3041337ABE4E7402159155
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

HubApps

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\HubApps
Size 106KB
SHA256 eb2fd7422436fff93f6be09df3294b26cdb7afd18e6aa94dcdc0f208db78b2ed
MD5 25dca813dd764f2197142ef84bc5ce66
SHA1 8d6aefb01ee9f6d1fb0cfd89326cfe35af53a53d
SHA512 a9c8cd547c874b7b69cbb3a0c8214f43837911e522db768dcd075d23d05acfd7122cf2bcad281ea745025e4fb67cc9061b79f9dc1288ac1a113bd0d961841d43
SSDEEP 1536:IfEEtnH74ohBGZqW3iPPDuVvpBI/SvtZsA62UYPq:BuHSRhPjU1
TLSH
T154B35226D6A54C6B01F16264EC794382F325436F9282A82F3B7C5D5C2FBD93A6502F7C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 1KB
SHA256 9dbbf4c4235694b5f36784eb50ae7f4bda7d1d293679d25bbbad44c08b7d613e
MD5 7f3004de4b3f9a5ee1f81dba8a96a768
SHA1 992a56889755e71855d2e5afee32e48ca056b048
SHA512 2c1d2db98c98be3a1cbeba0fc2b847e1b73e28fca960db57866226a141ca37de8db8443edc62c2bfd594cbb2d980b34678f84a50774b59bd258c35543ea6b4a0
TLSH
T15A419DF3C3E8857D891156F4BB186E2BCE2D096483683C5AC9E4AF5B93F2871E14095F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

e5349e17-a7c9-4dd5-8e17-8764b28c282a.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\e5349e17-a7c9-4dd5-8e17-8764b28c282a.tmp
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 5e079302aaf1cf3d41b62ecd017bfcbc4b0a2c7b5eeedcb697425626e652cbc4
MD5 51ce98fdac5b7369e1d9758d501d34a4
SHA1 eaa719b7816c063fa590552fd6a4a0bb735ba3f0
SHA512 9a4873c11fb67bb84eac8a2e913bda9c5c968967d7c59add28997d19a6131f175092ec0afc1bacd8e1138caf104428fcf9f2b784d3d11528cee669b1d587d4d0
SSDEEP 192:sxRFR/yM/jK1Ml8wFe/fLsHAAIykzoA8p47l/g6+WNIYPPUpGE57IgDAJ:sxRFZbe/fLsHfXI/5IL55T4
TLSH
T12262D9166A2859778CDBD20DFA557F53D6F91473F2941E44AAFC8A0C00E6EED221382F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 b9736788b9ef92541676e74c7bca79c1a1b03f6933ebd49162f4b05beb48fed7
MD5 22e3bc544ab869819bc5fc5c1e45f9c1
SHA1 5a312b6c1164a4c682b7551bf831c1d24f34e2b5
SHA512 36564e8b35ee3d65254b97ac3f106b27af27aada7f99c57e76bdd0bf8c244bb1c50731fd9ec9f577dcb953b68523e674a9955afa0a0e5e74997ccdeb441e524f
SSDEEP 192:sxRFR/yM/jK1Ml8UQ/Fe/fLsHAwIykzoA8pe7l/g6+WNIYPlUpGE57IgDiJ:sxRFZq9e/fLsHfXG/5Ir55Ty
TLSH
T13262C816A62859778CDBE21DFA557F53D6F91472F2940E04AAFCCB0C00E6ADD221382F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 80cddf5db1ceb4815d1b2b3ad7cf8997b2543a4d1ad96a7e53443870871237d6
MD5 7ff8c06f0eb22d398bf910ded9c02e8b
SHA1 7cbbf20ecec053949fc74615b83737bc8e951e47
SHA512 e6adb91184144d5eb6ba24cb333a85ba0d580d4a1525f82115e69f48dcad542b220d63443afe3cc9652c10f663661a825651980f0c9a33122f86ea82d20edc26
SSDEEP 192:sxRCR/yM/jK1Ml8wFe/fLs3AAIykzoA8p47l/g6+WNIYPPUpGE57IgIJ:sxRCZbe/fLs3fXI/5IL55Ts
TLSH
T15152D8156A28597B8CDBD20DFA557F53D6F91473F2944E04AAFCCA0C00E6AED221382F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 27KB
SHA256 7e5447ddc518ba6abe4b84610601ab3d943ba667c44f4ce3b3e7843b68025d95
MD5 37cd81f2d718c27480134735c21405c1
SHA1 60f5719672038dd6b579f6885a371bcb266367d8
SHA512 b684fbc060cf1b8fa3f4069e24a4a22abfd7f578aeb7f3a14355e9f39170783e783aaeef7ae62830ee26a8f08db74b333f9ed1bc32c155e4677e284772e8594a
SSDEEP 768:LKKg6xWgdVf7k8F1+UoAYDCx9Tuqh0VfUC9xbog/OVJ3nYGrouevdWeume:LKKg6xWgdVf7ku1jaY3Y9uevdW/me
TLSH
T123C2FC2B240CCB7E4F844E9DAD2ABE976DD801CB97584D9447FA880C03D67EB521A4DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 08f3454f4291a9f64890f7d7ad71e8f1f9366d718f7e2b8bfa24e2dedd44ecf4
MD5 fcbe97ae15aaa0bdb4187c75271dd6ab
SHA1 6f454d20f5115dac626fabbbab8e34196cff909a
SHA512 c06cf3f2e18254dc5654e49a78799dccbab701876d210bdd4a9e93e654d8ccc7774c78cce730fa094d9c25e6b7554096b1904076a0878e70650c178a601dcd4d
SSDEEP 48:KwpYd5DPTgvXizIOBgK51BbgNRw0S7JtyR6IfKf6kr/ALPNRdgxp+zICHgKP1HVs:KE2kKHKiy6IKf6EogK9iCe
TLSH
T1FE914045767A62102CBE39099071852E678134B3355AA93F7BBE20E70E6BE011EFCDD9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

OperationConfig

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig~RFe59c058.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig~RFe59c058.TMP
Size 3KB
SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
MD5 904e6e94a1d46374c8630cfd86cc729f
SHA1 e1d9c3f7813878acc6510d48d95b2bf48b2e1a0d
SHA512 081e2a26252860ff8d8f7a9d0378ae56f0cc50574d13d2a121afdf74284963747ef874a4d73b1df7774cd8570972f4f513eefe0a0325fd088556d5b1ba946712
TLSH
T1DB815C4FCC0CBE77ABAB6A719A35D6B2F79131EA94518A977F8C444EE3050ED0242E50
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 35KB
SHA256 914b76beda22698e5fdd9d5334e236e58ae9a7e12ce7823c7279eadb38a54fea
MD5 36edd53049d612d4085575f8e2b04fa6
SHA1 4fd69d1dd7cd7756073d857ea120998582862fe6
SHA512 c2ff8b46c4d46d3c90237a705d37691c564ba701b01f472da6edb91dbad912a8122010818344b2eb54d648f9946c58f2f3257ee3bdb58df5989b1199767357c6
SSDEEP 768:ulj+9x3ghCacO6MZ75riXYUsZUgb9eHc1dx1vl:uQ9x3YiIUsZUgb9sQdvl
TLSH
T105F2BF70AAA4DC674CE297C4B326364B2FF551A381C51D8898CD7F0D4AD7AAE434FC1A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 41KB
SHA256 ab3470da140f3123a1cc296c4257111a99242c12d2314ad47f2751721018cd64
MD5 14f3f4899b081134f89a543dcdd335fe
SHA1 1b0291c629c5733a9bf3d8058d4a866ba1e9de61
SHA512 5bc9ed3ff95ece8de98352c074bec12fe13ba71e6344c5621e8490bcf24d607de9d118ca2a97f460e15474933987e29bc5f3aa87863308ceb525e4c008cc2185
SSDEEP 768:oqjaeqD4MlshiLdMmL3YnhtacO6Mp75riXYUsZUgb9eHc1dxAT1:oqqcjhIdMU3TiIUsZUgb9sQy
TLSH
T1B513CF75ADF4DCA74CB296C5B32675871FB441A382C52D8898CD7F0E06D76DE420BC2A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 35KB
SHA256 d4113ffc44cc1a4886aa55a181ee47da180a2557c5d5fb6ec94b8ad028f4d8b8
MD5 86da82f759a6d9960440b22da12751db
SHA1 4e6410257525782d5495915dfc103d42fbacfc84
SHA512 6a19c8e4f1c2ee748f39de0bb0b8cad67c5d35a6239648392b41c54ae70218e10bcb99245f72004ddd46be1aa5621adc631a138b1563ce66eb769158fa34f03d
SSDEEP 768:olj+9x3fhCacO6MZ75riXYUsZUgb9eHc1dx1vl:oQ9x3XiIUsZUgb9sQdvl
TLSH
T1C4F2BF70AAE4DC674CE297C4B326364B2FB551A381C51D8898CD7F0D4AD7AAE434FC1A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 37KB
SHA256 7dd735821bf9fc87a546abcf680f30014e8a187186df57ea917723eca03406d4
MD5 1ddbecc3c79e6401981469f5a8b81739
SHA1 1aaf4e91b0b799e2f87482f4fcf485070f0400f0
SHA512 d923ac32abe5b71ce384f1bc31576b42111c4eef9cfd188ca3743ae69b005df8e278073576da172c1662002a1d72b8dc49c34a3d291638f9a1283d83e86d8375
SSDEEP 768:mLF1j+9B3IwgRhCacO6M175riXYUsZUgb9eHc1dx1vl:mK9B3eiIUsZUgb9sQdvl
TLSH
T19D03BF72A9E4DC6B4CF29BC4F32A324B5FF151A380C569849ACC6E0D06D76ED434BC15
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 6eb4e186f50cf527c15e39b30aa638bd070e5148ae10c78695dfd627fef820f8
MD5 f18d32a1c506f962a063835bdd1dadd2
SHA1 28f12b25344feb42a5c0d106185f92c8a5e18f47
SHA512 8c473af86a2961082ae78802376490073a32bd46a2b810cb94d5a250e831097133611812a39f6a51d4e5e839802c537e6740c430b2a458071ed468e421e848ca
SSDEEP 768:ZkjaeqD4MlshiLdMmJ3iUIcO6D75riXYUsZUgb9eHUD+ApXTcHT+:ZkqcjhIdMG3iMiIUsZUgb9sS+KXP
TLSH
T12403C07999A48C678CF2D7C5B36765472FB501E386C52EDC98CC6B0D02E36DE530782A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e32396d0-3ed6-4e2c-80af-fb0e56f720d8.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\e32396d0-3ed6-4e2c-80af-fb0e56f720d8.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download